Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita35a527

Browse files
committed
Fix some possible low-memory failures in regexp compilation.
newnfa() failed to set the regex error state when malloc() fails.Several places in regcomp.c failed to check for an error after callingsubre(). Each of these mistakes could lead to null-pointer-dereferencecrashes in memory-starved backends.Report and patch by Andreas Seltenreich. Back-patch to all branches.
1 parente9a080d commita35a527

File tree

2 files changed

+6
-0
lines changed

2 files changed

+6
-0
lines changed

‎src/backend/regex/regc_nfa.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,10 @@ newnfa(struct vars * v,
5252

5353
nfa= (structnfa*)MALLOC(sizeof(structnfa));
5454
if (nfa==NULL)
55+
{
56+
ERR(REG_ESPACE);
5557
returnNULL;
58+
}
5659

5760
nfa->states=NULL;
5861
nfa->slast=NULL;

‎src/backend/regex/regcomp.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -942,6 +942,7 @@ parseqatom(struct vars * v,
942942
NOERR();
943943
assert(v->nextvalue>0);
944944
atom=subre(v,'b',BACKR,lp,rp);
945+
NOERR();
945946
subno=v->nextvalue;
946947
atom->subno=subno;
947948
EMPTYARC(lp,rp);/* temporarily, so there's something */
@@ -1076,6 +1077,7 @@ parseqatom(struct vars * v,
10761077

10771078
/* break remaining subRE into x{...} and what follows */
10781079
t=subre(v,'.',COMBINE(qprefer,atom->flags),lp,rp);
1080+
NOERR();
10791081
t->left=atom;
10801082
atomp=&t->left;
10811083

@@ -1084,6 +1086,7 @@ parseqatom(struct vars * v,
10841086
/* split top into prefix and remaining */
10851087
assert(top->op=='='&&top->left==NULL&&top->right==NULL);
10861088
top->left=subre(v,'=',top->flags,top->begin,lp);
1089+
NOERR();
10871090
top->op='.';
10881091
top->right=t;
10891092

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp