svn commit: r300378 - head/lib/libc/regex

[Pedro F. Giffuni]

Author: pfg
Date: Sat May 21 19:54:10 2016
New Revision: 300378
URL: https://svnweb.freebsd.org/changeset/base/300378

Log:
  libc/regex: fix two buffer underruns.
  
  Fix some rather complex regex issues found on OpenBSD as part of some
  ongoing work to fix a sed(1) bug.
  
  Curiously the OpenBSD tests don't trigger segfaults on FreeBSD but the
  bugs were confirmed by running a port of FreeBSD's regex under OpenBSD's
  malloc. Huge thanks to Ingo for confirming the behavior.
  
  Taken from:	Ingo Schwarze (through openbsd-tech 2016-05-15)
  MFC after:	1 week

Modified:
  head/lib/libc/regex/engine.c

Modified: head/lib/libc/regex/engine.c
==============================================================================
--- head/lib/libc/regex/engine.c	Sat May 21 17:52:44 2016	(r300377)
+++ head/lib/libc/regex/engine.c	Sat May 21 19:54:10 2016	(r300378)
@@ -606,9 +606,9 @@ backref(struct match *m,
 				return(NULL);
 			break;
 		case OBOL:
-			if ( (sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
-					(sp < m->endp && *(sp-1) == '\n' &&
-						(m->g->cflags&REG_NEWLINE)) )
+			if ((sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
+			    (sp > m->offp && sp < m->endp &&
+			    *(sp-1) == '\n' && (m->g->cflags&REG_NEWLINE)))
 				{ /* yes */ }
 			else
 				return(NULL);
@@ -622,12 +622,9 @@ backref(struct match *m,
 				return(NULL);
 			break;
 		case OBOW:
-			if (( (sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
-					(sp < m->endp && *(sp-1) == '\n' &&
-						(m->g->cflags&REG_NEWLINE)) ||
-					(sp > m->beginp &&
-							!ISWORD(*(sp-1))) ) &&
-					(sp < m->endp && ISWORD(*sp)) )
+			if (sp < m->endp && ISWORD(*sp) &&
+			    ((sp == m->beginp && !(m->eflags&REG_NOTBOL)) ||
+			    (sp > m->offp && !ISWORD(*(sp-1)))))
 				{ /* yes */ }
 			else
 				return(NULL);