Re: bug#32592: heap-use-after-free in regex module

2018-09-06 Thread Jim Meyering
On Thu, Sep 6, 2018 at 12:18 AM Paul Eggert wrote: > Jim Meyering wrote: > > I couldn't help but notice this nonsense right after the line > > you inserted: > > > >if (err == REG_NOMATCH) > > continue; > > } > > > > That is an "if (...) continue;" just before the

Re: bug#32592: heap-use-after-free in regex module

2018-09-06 Thread Paul Eggert
Assaf Gordon wrote: Speaking of coincidences, I just found this use-after-free bug was already reported (but not fixed) back in 2015:https://sourceware.org/bugzilla/show_bug.cgi?id=18040 . Thanks, I had looked for a duplicate bug report before filing glibc bug 23609 but did not find that one.

Re: bug#32592: heap-use-after-free in regex module

2018-09-06 Thread Assaf Gordon
Thank you all for the review and comments. On Thu, Sep 6, 2018 at 1:18 AM, Paul Eggert wrote: > What a coincidence that we would find two bugs right next to each other, > huh?... > > I filed a bug report against glibc, and unless there's an objection I would > like to fix both bugs in glibc and p

Re: bug#32592: heap-use-after-free in regex module

2018-09-06 Thread Paul Eggert
Jim Meyering wrote: I couldn't help but notice this nonsense right after the line you inserted: if (err == REG_NOMATCH) continue; } That is an "if (...) continue;" just before the closing brace of a for-loop. Those two lines constitute a no-op and should be remo

Re: bug#32592: heap-use-after-free in regex module

2018-09-05 Thread Jim Meyering
On Wed, Sep 5, 2018 at 6:28 PM Assaf Gordon wrote: > > Bruno alerted me off-list: > > On 05/09/18 07:19 PM, Bruno Haible wrote: > > Is the ChangeLog entry up-to-date? > > > > +* regexec.c (get_subexp): Update 'buf' after call to get_subexp_sub. > > +Additionally, check for allocation e

Re: bug#32592: heap-use-after-free in regex module

2018-09-05 Thread Jim Meyering
On Wed, Sep 5, 2018 at 6:08 PM Assaf Gordon wrote: > Assuming the gnulib bugfix is valid (in my previous email), > I suggest adding the following test to sed (after updating gnulib). Thank you, Assaf. Only tiny suggestions: sed-test-tweak.diff Description: Binary data

Re: bug#32592: heap-use-after-free in regex module

2018-09-05 Thread Assaf Gordon
Bruno alerted me off-list: On 05/09/18 07:19 PM, Bruno Haible wrote: > Is the ChangeLog entry up-to-date? > > + * regexec.c (get_subexp): Update 'buf' after call to get_subexp_sub. > + Additionally, check for allocation errors and bail out if needed. > > I don't see a code change for > "check f

Re: bug#32592: heap-use-after-free in regex module

2018-09-05 Thread Assaf Gordon
Hello, Assuming the gnulib bugfix is valid (in my previous email), I suggest adding the following test to sed (after updating gnulib). comments welcomed, - assaf >From bc2794c76cd4202df5172bdbe364a4006e6edbe6 Mon Sep 17 00:00:00 2001 From: Assaf Gordon Date: Wed, 5 Sep 2018 18:58:55 -0600 Sub

Re: bug#32592: heap-use-after-free in regex module

2018-09-05 Thread Assaf Gordon
Hello, On Wed, Sep 5, 2018 at 12:32 AM Assaf Gordon wrote: On 04/09/18 07:02 PM, Saito Takaaki wrote:>>> https://ideone.com/Sq5xJX>> I hope this helps even a bit. The linked snippet you provided exposed a heap-use-after-free bug in gnulib's regex module (possibly in glibc as well

Re: bug#32592: heap-use-after-free in regex module (was: s with i modifier seems to work incorrectly)

2018-09-05 Thread Jim Meyering
On Wed, Sep 5, 2018 at 12:32 AM Assaf Gordon wrote: > > (adding gnulib) > > On 04/09/18 07:02 PM, Saito Takaaki wrote: > [... discussing a sed bug ...] > > However, a friend showed me a more complex case which is > > problematic even with sed 4.4 on ideone. The last two lines of the > > output (f