svn commit: r300964 - stable/9/lib/libc/regex

[Pedro F. Giffuni]

Author: pfg
Date: Sun May 29 16:32:56 2016
New Revision: 300964
URL: https://svnweb.freebsd.org/changeset/base/300964

Log:
  MFC r300378:
  libc/regex: fix two buffer underruns.
  
  Fix some rather complex regex issues found on OpenBSD as part of some
  ongoing work to fix a sed(1) bug.
  
  Curiously the OpenBSD tests don't trigger segfaults on FreeBSD but the
  bugs were confirmed by running a port of FreeBSD's regex under OpenBSD's
  malloc. Huge thanks to Ingo for confirming the behavior.
  
  Obtained from:	OpenBSD (CVS 1.20, 1.21)

Modified:
  stable/9/lib/libc/regex/engine.c
Directory Properties:
  stable/9/lib/libc/   (props changed)

Modified: stable/9/lib/libc/regex/engine.c
==============================================================================
--- stable/9/lib/libc/regex/engine.c	Sun May 29 16:32:21 2016	(r300963)
+++ stable/9/lib/libc/regex/engine.c	Sun May 29 16:32:56 2016	(r300964)
@@ -606,9 +606,9 @@ backref(struct match *m,
 				return(NULL);
 			break;
 		case OBOL:
-			if ( (sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
-					(sp < m->endp && *(sp-1) == '\n' &&
-						(m->g->cflags&REG_NEWLINE)) )
+			if ((sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
+			    (sp > m->offp && sp < m->endp &&
+			    *(sp-1) == '\n' && (m->g->cflags&REG_NEWLINE)))
 				{ /* yes */ }
 			else
 				return(NULL);
@@ -622,12 +622,9 @@ backref(struct match *m,
 				return(NULL);
 			break;
 		case OBOW:
-			if (( (sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
-					(sp < m->endp && *(sp-1) == '\n' &&
-						(m->g->cflags&REG_NEWLINE)) ||
-					(sp > m->beginp &&
-							!ISWORD(*(sp-1))) ) &&
-					(sp < m->endp && ISWORD(*sp)) )
+			if (sp < m->endp && ISWORD(*sp) &&
+			    ((sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
+			    (sp > m->offp && !ISWORD(*(sp-1)))))
 				{ /* yes */ }
 			else
 				return(NULL);