misc/126682: Sed segfaults on error rather than error message

[Derek Tattersall]

>Number:         126682
>Category:       misc
>Synopsis:       Sed segfaults on error rather than error message
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Aug 20 14:10:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Derek Tattersall
>Release:        8.0 CURRENT
>Organization:
>Environment:
FreeBSD oriental.arm.org 8.0-CURRENT FreeBSD 8.0-CURRENT #16: Sun Aug 17 11:41:53 EDT 2008     root at oriental.arm.org:/usr/obj/usr/src/sys/ORIENTAL  amd64
>Description:
echo test | sed 's/test/\1/' segfaults rather than issuing a message regarding the nonexistence of what "\1" refers to.
>How-To-Repeat:
echo test | sed 's/test/\1/'
>Fix:


Patch attached with submission follows:

diff -u /usr/src/usr.bin/sed/compile.c ./compile.c
--- /usr/src/usr.bin/sed/compile.c	2008-02-09 04:12:02.000000000 -0500
+++ ./compile.c	2008-08-20 09:47:27.000000000 -0400
@@ -324,13 +324,13 @@
 			if (p == NULL)
 				errx(1,
 				"%lu: %s: unterminated substitute pattern", linenum, fname);
-			--p;
-			p = compile_subst(p, cmd->u.s);
-			p = compile_flags(p, cmd->u.s);
 			if (*re == '\0')
 				cmd->u.s->re = NULL;
 			else
 				cmd->u.s->re = compile_re(re, cmd->u.s->icase);
+			--p;
+			p = compile_subst(p, cmd->u.s);
+			p = compile_flags(p, cmd->u.s);
 			EATSPACE();
 			if (*p == ';') {
 				p++;


>Release-Note:
>Audit-Trail:
>Unformatted: