|
 |
dfa863 |
From 0b91d6928e9d098d3746ce9f4bb4160a2e685f5c Mon Sep 17 00:00:00 2001
|
|
|
dfa863 |
From: Jim Meyering <meyering@redhat.com>
|
|
|
dfa863 |
Date: Fri, 17 Jun 2011 08:27:06 +0000
|
|
|
dfa863 |
Subject: dfa: don't overrun a malloc'd buffer for certain regexps
|
|
|
dfa863 |
|
|
|
dfa863 |
* src/dfa.c (dfaanalyze): Allocate space for twice as many
|
|
|
dfa863 |
positions as there are leaves. Before this change, for some
|
|
|
dfa863 |
regular expressions, DFA analysis would have inserted far more
|
|
|
dfa863 |
"positions" than dfa->nleaves (up to double).
|
|
|
dfa863 |
Reported by Raymond Russell in http://savannah.gnu.org/bugs/?33547
|
|
|
dfa863 |
* tests/dfa-heap-overrun: Trigger the overrun.
|
|
|
dfa863 |
* tests/Makefile.am (TESTS): Add it.
|
|
|
dfa863 |
* NEWS (Bug fixes): Mention it.
|
|
|
dfa863 |
|
|
|
dfa863 |
|
|
|
dfa863 |
NEWS hunk modified to apply, Jaroslav Škarvada <jskarvad@redhat.com>
|
|
|
dfa863 |
---
|
|
|
dfa863 |
diff --git a/NEWS b/NEWS
|
|
|
dfa863 |
index d026448..3354d50 100644
|
|
|
dfa863 |
--- a/NEWS
|
|
|
dfa863 |
+++ b/NEWS
|
|
|
dfa863 |
@@ -4,6 +4,9 @@ GNU grep NEWS -*- outline -*-
|
|
|
dfa863 |
|
|
|
dfa863 |
** Bug fixes
|
|
|
dfa863 |
|
|
|
dfa863 |
+ grep no longer clobbers heap for an ERE like '(^| )*( |$)'
|
|
|
dfa863 |
+ [bug introduced in grep-2.6]
|
|
|
dfa863 |
+
|
|
|
dfa863 |
echo c|grep '[c]' would fail for any c in 0x80..0xff, and in many locales.
|
|
|
dfa863 |
E.g., printf '\xff\n'|grep "$(printf '[\xff]')" || echo FAIL
|
|
|
dfa863 |
would print FAIL rather than the required matching line.
|
|
|
dfa863 |
|
|
|
dfa863 |
diff --git a/src/dfa.c b/src/dfa.c
|
|
|
dfa863 |
index 873530f..c32d679 100644
|
|
|
dfa863 |
--- a/src/dfa.c
|
|
|
dfa863 |
+++ b/src/dfa.c
|
|
|
dfa863 |
@@ -2134,7 +2134,7 @@ dfaanalyze (struct dfa *d, int searchflag)
|
|
|
dfa863 |
MALLOC(lastpos, position, d->nleaves);
|
|
|
dfa863 |
o_lastpos = lastpos, lastpos += d->nleaves;
|
|
|
dfa863 |
CALLOC(nalloc, int, d->tindex);
|
|
|
dfa863 |
- MALLOC(merged.elems, position, d->nleaves);
|
|
|
dfa863 |
+ MALLOC(merged.elems, position, 2 * d->nleaves);
|
|
|
dfa863 |
|
|
|
dfa863 |
CALLOC(d->follows, position_set, d->tindex);
|
|
|
dfa863 |
|
|
|
dfa863 |
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
|
|
dfa863 |
index 8d51727..1f0d2cf 100644
|
|
|
dfa863 |
--- a/tests/Makefile.am
|
|
|
dfa863 |
+++ b/tests/Makefile.am
|
|
|
dfa863 |
@@ -46,6 +46,7 @@ TESTS = \
|
|
|
dfa863 |
case-fold-char-range \
|
|
|
dfa863 |
case-fold-char-type \
|
|
|
dfa863 |
char-class-multibyte \
|
|
|
dfa863 |
+ dfa-heap-overrun \
|
|
|
dfa863 |
dfaexec-multibyte \
|
|
|
dfa863 |
empty \
|
|
|
dfa863 |
equiv-classes \
|
|
|
dfa863 |
@@ -103,7 +104,6 @@ MALLOC_PERTURB_ = 1
|
|
|
dfa863 |
TESTS_ENVIRONMENT = \
|
|
|
dfa863 |
tmp__=$$TMPDIR; test -d "$$tmp__" || tmp__=.; \
|
|
|
dfa863 |
TMPDIR=$$tmp__; export TMPDIR; \
|
|
|
dfa863 |
- exec 9>&2; \
|
|
|
dfa863 |
shell_or_perl_() { \
|
|
|
dfa863 |
if grep '^\#!/usr/bin/perl' "$$1" > /dev/null; then \
|
|
|
dfa863 |
if $(PERL) -e 'use warnings' > /dev/null 2>&1; then \
|
|
|
dfa863 |
@@ -141,6 +141,6 @@ TESTS_ENVIRONMENT = \
|
|
|
dfa863 |
PERL='$(PERL)' \
|
|
|
dfa863 |
SHELL='$(SHELL)' \
|
|
|
dfa863 |
PATH='$(abs_top_builddir)/src$(PATH_SEPARATOR)'"$$PATH" \
|
|
|
dfa863 |
- ; shell_or_perl_
|
|
|
dfa863 |
+ ; shell_or_perl_ 9>&2
|
|
|
dfa863 |
|
|
|
dfa863 |
VERBOSE = yes
|
|
|
dfa863 |
diff --git a/tests/dfa-heap-overrun b/tests/dfa-heap-overrun
|
|
|
dfa863 |
new file mode 100755
|
|
|
dfa863 |
index 0000000..dda1c12
|
|
|
dfa863 |
--- a/dev/null
|
|
|
dfa863 |
+++ b/tests/dfa-heap-overrun
|
|
|
dfa863 |
@@ -0,0 +1,26 @@
|
|
|
dfa863 |
+#!/bin/sh
|
|
|
dfa863 |
+# Trigger a heap overrun in grep-2.6..grep-2.8.
|
|
|
dfa863 |
+
|
|
|
dfa863 |
+# Copyright (C) 2011 Free Software Foundation, Inc.
|
|
|
dfa863 |
+
|
|
|
dfa863 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
dfa863 |
+# it under the terms of the GNU General Public License as published by
|
|
|
dfa863 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
dfa863 |
+# (at your option) any later version.
|
|
|
dfa863 |
+
|
|
|
dfa863 |
+# This program is distributed in the hope that it will be useful,
|
|
|
dfa863 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
dfa863 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
dfa863 |
+# GNU General Public License for more details.
|
|
|
dfa863 |
+
|
|
|
dfa863 |
+# You should have received a copy of the GNU General Public License
|
|
|
dfa863 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
dfa863 |
+
|
|
|
dfa863 |
+. "${srcdir=.}/init.sh"; path_prepend_ ../src
|
|
|
dfa863 |
+
|
|
|
dfa863 |
+fail=0
|
|
|
dfa863 |
+
|
|
|
dfa863 |
+grep -E '(^| )*(a|b)*(c|d)*( |$)' < /dev/null
|
|
|
dfa863 |
+test $? = 1 || fail=1
|
|
|
dfa863 |
+
|
|
|
dfa863 |
+Exit $fail
|
|
|
dfa863 |
--
|
|
|
dfa863 |
cgit v0.8.3.4
|