bug#32271: heap buffer overflow in regexp.c, line 286

[Assaf Gordon]

tags 32271 fixed
close 32271
stop

On 02/08/18 09:15 AM, Jim Meyering wrote:
> On Fri, Jul 27, 2018 at 12:13 PM, Assaf Gordon <address@hidden> wrote:
> > On 25/07/18 08:34 AM, project-repo wrote:
> > > I let the fuzzer run again and it came up with a second heap buffer
> > > overflow. This time in regexp.c, line 286. Here is a backtrace as
> > > supplied by the address sanitizer:
> > The two attached patches should explain it in detail.
> >
> > As these changes are somewhat subtle, I encourage everyone to
> > double-check them...
>
> Fine work, yet again. Thank you!
> I did spot one nit: the addition of two leading TAB bytes in the
> latter patch. Should be 8 spaces, of course:

Thanks for the review.

Pushed here:
https://git.savannah.gnu.org/cgit/sed.git/commit/?id=2cb09e14
https://git.savannah.gnu.org/cgit/sed.git/commit/?id=007a4176

-assaf