bug#34133: Huge memory usage and output size when using "H" and "G"

[Hongxu Chen]

Hi,

    We found an issue that are relevant to use of "H" and "G" for appending
hold space and pattern space.

    The input file is attached which is a file of 30 lines and 80 columns
filled with 'a'. And my memory is 64G with equivalent swap.

      # these two may eat up the memory
    sed 's/a/d/; G; H;' input
    sed '/b/d; G; H;' input

     # this is fine
    sed '/a/d; G; H;' input

    I learned from http://www.grymoire.com/Unix/Sed.html that 'G' appends
hold space to pattern space, and 'H' does the inverse.
    In the first two examples, the buffer of hold space will be appended to
pattern space, and subsequently content of pattern space will be appended
to hold space once more. With one more input line, the two buffers will be
doubled; and as long as the input file is big enough, sed may finally eat
up the memory and populate the output.
    We think this is vulnerable since it may eat up the memory in a few
seconds.

Best Regards,
Hongxu

input
Description: Binary data