13d99c
--- a/THANKS
13d99c
+++ b/THANKS
13d99c
@@ -70,6 +70,7 @@ Mike Frysinger             <vapier@gentoo.org>
13d99c
 Miles Bader                <miles@ccs.mt.nec.co.jp>
13d99c
 Mirraz Mirraz              <mirraz1@rambler.ru>
13d99c
 Nelson H. F. Beebe         <beebe@math.utah.edu>
13d99c
+Nima Aghdaii               <naghdaii@fb.com>
13d99c
 Olaf Kirch                 <okir@ns.lst.de>
13d99c
 Paolo Bonzini              <bonzini@gnu.org>
13d99c
 Paul Eggert                <eggert@twinsun.com>
13d99c
--- a/src/kwset.c
13d99c
+++ b/src/kwset.c
13d99c
@@ -643,6 +643,8 @@ bmexec_trans (kwset_t kwset, char const *text, size_t size)
13d99c
                     if (! tp)
13d99c
                       return -1;
13d99c
                     tp++;
13d99c
+                    if (ep <= tp)
13d99c
+                      break;
13d99c
                   }
13d99c
               }
13d99c
           }
13d99c
--- a/tests/Makefile.am
13d99c
+++ b/tests/Makefile.am
13d99c
@@ -72,6 +72,7 @@ TESTS =						\
13d99c
   inconsistent-range				\
13d99c
   invalid-multibyte-infloop			\
13d99c
   khadafy					\
13d99c
+  kwset-abuse					\
13d99c
   long-line-vs-2GiB-read			\
13d99c
   max-count-overread				\
13d99c
   max-count-vs-context				\
13d99c
--- a/tests/Makefile.in
13d99c
+++ b/tests/Makefile.in
13d99c
@@ -1371,6 +1371,7 @@ TESTS = \
13d99c
   inconsistent-range				\
13d99c
   invalid-multibyte-infloop			\
13d99c
   khadafy					\
13d99c
+  kwset-abuse					\
13d99c
   long-line-vs-2GiB-read			\
13d99c
   max-count-overread				\
13d99c
   max-count-vs-context				\
13d99c
@@ -2021,6 +2022,13 @@ khadafy.log: khadafy
13d99c
 	--log-file $$b.log --trs-file $$b.trs \
13d99c
 	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
13d99c
 	"$$tst" $(AM_TESTS_FD_REDIRECT)
13d99c
+kwset-abuse.log: kwset-abuse
13d99c
+	@p='kwset-abuse'; \
13d99c
+	b='kwset-abuse'; \
13d99c
+	$(am__check_pre) $(LOG_DRIVER) --test-name "$$f" \
13d99c
+	--log-file $$b.log --trs-file $$b.trs \
13d99c
+	$(am__common_driver_flags) $(AM_LOG_DRIVER_FLAGS) $(LOG_DRIVER_FLAGS) -- $(LOG_COMPILE) \
13d99c
+	"$$tst" $(AM_TESTS_FD_REDIRECT)
13d99c
 long-line-vs-2GiB-read.log: long-line-vs-2GiB-read
13d99c
 	@p='long-line-vs-2GiB-read'; \
13d99c
 	b='long-line-vs-2GiB-read'; \
13d99c
--- a/dev/null
13d99c
+++ b/tests/kwset-abuse
13d99c
@@ -0,0 +1,32 @@
13d99c
+#! /bin/sh
13d99c
+# Evoke a segfault in a hard-to-reach code path of kwset.c.
13d99c
+# This bug affected grep versions 2.19 through 2.21.
13d99c
+#
13d99c
+# Copyright (C) 2015 Free Software Foundation, Inc.
13d99c
+#
13d99c
+# This program is free software: you can redistribute it and/or modify
13d99c
+# it under the terms of the GNU General Public License as published by
13d99c
+# the Free Software Foundation, either version 3 of the License, or
13d99c
+# (at your option) any later version.
13d99c
+
13d99c
+# This program is distributed in the hope that it will be useful,
13d99c
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
13d99c
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13d99c
+# GNU General Public License for more details.
13d99c
+
13d99c
+# You should have received a copy of the GNU General Public License
13d99c
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
13d99c
+
13d99c
+. "${srcdir=.}/init.sh"; path_prepend_ ../src
13d99c
+
13d99c
+fail=0
13d99c
+
13d99c
+# This test case chooses a haystack of size 260,000, since prodding
13d99c
+# with gdb showed a reallocation slightly larger than that in fillbuf.
13d99c
+# To reach the buggy code, the needle must have length < 1/11 that of
13d99c
+# the haystack, and 10,000 is a nice round number that fits the bill.
13d99c
+printf '%0260000dXy\n' 0 | grep -F $(printf %010000dy 0)
13d99c
+
13d99c
+test $? = 1 || fail=1
13d99c
+
13d99c
+Exit $fail