Fix off-by-one errors
Andreas Schwab
schwab@suse.de
Fri Feb 6 15:21:00 GMT 2004
regcomp is accessing arrays outside their bounds.
Andreas.
2004-02-06 Andreas Schwab <schwab@suse.de>
* posix/regcomp.c (build_range_exp): Fix off-by-one.
(parse_bracket_exp): Likewise.
Index: posix/regcomp.c
===================================================================
RCS file: /cvs/glibc/libc/posix/regcomp.c,v
retrieving revision 1.77
diff -u -p -a -u -p -a -r1.77 posix/regcomp.c
--- posix/regcomp.c 30 Jan 2004 05:19:45 -0000 1.77
+++ posix/regcomp.c 6 Feb 2004 15:04:44 -0000
@@ -2603,7 +2603,7 @@ build_range_exp (sbcset, start_elem, end
}
/* Build the table for single byte characters. */
- for (wc = 0; wc <= SBC_MAX; ++wc)
+ for (wc = 0; wc < SBC_MAX; ++wc)
{
cmp_buf[2] = wc;
if (wcscoll (cmp_buf, cmp_buf + 2) <= 0
@@ -2623,7 +2623,7 @@ build_range_exp (sbcset, start_elem, end
if (start_ch > end_ch)
return REG_ERANGE;
/* Build the table for single byte characters. */
- for (ch = 0; ch <= SBC_MAX; ++ch)
+ for (ch = 0; ch < SBC_MAX; ++ch)
if (start_ch <= ch && ch <= end_ch)
bitset_set (sbcset, ch);
}
@@ -2846,7 +2846,7 @@ parse_bracket_exp (regexp, dfa, token, s
}
/* Build the table for single byte characters. */
- for (ch = 0; ch <= SBC_MAX; ch++)
+ for (ch = 0; ch < SBC_MAX; ch++)
{
uint32_t ch_collseq;
/*
--
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux AG, MaxfeldstraÃe 5, 90409 Nürnberg, Germany
Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."
More information about the Libc-hacker
mailing list