lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-30 22:43:12 +03:00
Code Activity

prune_impossible_nodes: Avoid overflow in computing re_malloc buffer size

Browse Source
This commit is contained in:
Paul Eggert
2010-01-22 12:03:56 -08:00
committed by Ulrich Drepper
parent daa8454919
commit 4cd028677b
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -1,5 +1,9 @@
2010-01-22 Jim Meyering <jim@meyering.net> 2010-01-22 Jim Meyering <jim@meyering.net>
[BZ #11189]
* posix/regexec.c (prune_impossible_nodes): Avoid overflow
in computing re_malloc buffer size.
[BZ #11188] [BZ #11188]
* posix/regexec.c (build_trtable): Avoid arithmetic overflow * posix/regexec.c (build_trtable): Avoid arithmetic overflow
in size calculation. in size calculation.

5
posix/regexec.c
View File

@ -949,6 +949,11 @@ prune_impossible_nodes (mctx)
#endif #endif
match_last = mctx->match_last; match_last = mctx->match_last;
halt_node = mctx->last_node; halt_node = mctx->last_node;
/* Avoid overflow. */
if (BE (SIZE_MAX / sizeof (re_dfastate_t *) <= match_last, 0))
return REG_ESPACE;
sifted_states = re_malloc (re_dfastate_t *, match_last + 1); sifted_states = re_malloc (re_dfastate_t *, match_last + 1);
if (BE (sifted_states == NULL, 0)) if (BE (sifted_states == NULL, 0))
{ {