[PATCH] Fix regex segfaults

Jakub Jelinek jakub@redhat.com
Mon Nov 10 23:20:00 GMT 2003


Hi!

The following patch seems to fix
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=109606
The problem is that only valid_len wchar_t's are meaningful in wcs
array, while len can be much larger.
valid_len covers complete characters (if mbrtowc during conversion
returns -2, conversion stops and valid_len is not increased by the
partial bytes, if it returns -1 or 0 then that char is stored into
wcs (so it is not WEOF).

2003-11-10  Jakub Jelinek  <jakub@redhat.com>

	* posix/regex_internal.h (re_string_char_size_at): Don't look beyond
	valid_len wide chars.

--- libc/posix/regex_internal.h.jj	2003-09-23 17:03:01.000000000 +0200
+++ libc/posix/regex_internal.h	2003-11-10 14:44:13.000000000 +0100
@@ -702,7 +702,7 @@ re_string_char_size_at (pstr, idx)
   int byte_idx;
   if (MB_CUR_MAX == 1)
     return 1;
-  for (byte_idx = 1; idx + byte_idx < pstr->len; ++byte_idx)
+  for (byte_idx = 1; idx + byte_idx < pstr->valid_len; ++byte_idx)
     if (pstr->wcs[idx + byte_idx] != WEOF)
       break;
   return byte_idx;

	Jakub



More information about the Libc-hacker mailing list