Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd3158f3

Browse files
committed
Fix regex back-references that are directly quantified with *.
The syntax "\n*", that is a backref with a * quantifier directly appliedto it, has never worked correctly in Spencer's library. This has been anopen bug in the Tcl bug tracker since 2005:https://sourceforge.net/tracker/index.php?func=detail&aid=1115587&group_id=10894&atid=110894The core of the problem is in parseqatom(), which first changes "\n*" to"\n+|" and then applies repeat() to the NFA representing the backref atom.repeat() thinks that any arc leading into its "rp" argument is part of thesub-NFA to be repeated. Unfortunately, since parseqatom() already createdthe arc that was intended to represent the empty bypass around "\n+", thisarc gets moved too, so that it now leads into the state loop created byrepeat(). Thus, what was supposed to be an "empty" bypass gets turned intosomething that represents zero or more repetitions of the NFA representingthe backref atom. In the original example, in place of^([bc])\1*$we now have something that acts like^([bc])(\1+|[bc]*)$At runtime, the branch involving the actual backref fails, as it's supposedto, but then the other branch succeeds anyway.We could no doubt fix this by some rearrangement of the operations inparseqatom(), but that code is plenty ugly already, and what's more thewhole business of converting "x*" to "x+|" probably needs to go away to fixanother problem I'll mention in a moment. Instead, this patch suppressesthe *-conversion when the target is a simple backref atom, leaving the caseof m == 0 to be handled at runtime. This makes the patch in regcomp.c aone-liner, at the cost of having to tweak cbrdissect() a little. In theevent I went a bit further than that and rewrote cbrdissect() to check allthe string-length-related conditions before it starts comparing characters.It seems a bit stupid to possibly iterate through many copies of ann-character backreference, only to fail at the end because the targetstring's length isn't a multiple of n --- we could have found that outbefore starting. The existing coding could only be a win if integerdivision is hugely expensive compared to character comparison, but I don'tknow of any modern machine where that might be true.This does not fix all the problems with quantified back-references. Inparticular, the code is still broken for back-references that appear withina larger expression that is quantified (so that direct insertion of thequantification limits into the BACKREF node doesn't apply). I think fixingthat will take some major surgery on the NFA code, specifically introducingan explicit iteration node type instead of trying to transform iterationinto concatenation of modified regexps.Back-patch to all supported branches. In HEAD, also add a regression testcase for this. (It may seem a bit silly to create a regression test filefor just one test case; but I'm expecting that we will soon import a wholebunch of regex regression tests from Tcl, so might as well create theinfrastructure now.)
1 parent86328cb commitd3158f3

File tree

2 files changed

+52
-29
lines changed

2 files changed

+52
-29
lines changed

‎src/backend/regex/regcomp.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1087,8 +1087,12 @@ parseqatom(struct vars * v,
10871087
NOERR();
10881088
}
10891089

1090-
/* it's quantifier time; first, turn x{0,...} into x{1,...}|empty */
1091-
if (m==0)
1090+
/*
1091+
* It's quantifier time. If the atom is just a BACKREF, we'll let it deal
1092+
* with quantifiers internally. Otherwise, the first step is to turn
1093+
* x{0,...} into x{1,...}|empty
1094+
*/
1095+
if (m==0&&atomtype!=BACKREF)
10921096
{
10931097
EMPTYARC(s2,atom->end);/* the bypass */
10941098
assert(PREF(qprefer)!=0);

‎src/backend/regex/regexec.c

Lines changed: 46 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -719,7 +719,7 @@ cdissect(struct vars * v,
719719
case'|':/* alternation */
720720
assert(t->left!=NULL);
721721
returncaltdissect(v,t,begin,end);
722-
case'b':/* backref -- shouldn't be calling us! */
722+
case'b':/* backreference */
723723
assert(t->left==NULL&&t->right==NULL);
724724
returncbrdissect(v,t,begin,end);
725725
case'.':/* concatenation */
@@ -976,12 +976,12 @@ cbrdissect(struct vars * v,
976976
chr*begin,/* beginning of relevant substring */
977977
chr*end)/* end of same */
978978
{
979-
inti;
980979
intn=t->subno;
981-
size_tlen;
982-
chr*paren;
980+
size_tnumreps;
981+
size_ttlen;
982+
size_tbrlen;
983+
chr*brstring;
983984
chr*p;
984-
chr*stop;
985985
intmin=t->min;
986986
intmax=t->max;
987987

@@ -992,46 +992,65 @@ cbrdissect(struct vars * v,
992992

993993
MDEBUG(("cbackref n%d %d{%d-%d}\n",t->retry,n,min,max));
994994

995+
/* get the backreferenced string */
995996
if (v->pmatch[n].rm_so==-1)
996997
returnREG_NOMATCH;
997-
paren=v->start+v->pmatch[n].rm_so;
998-
len=v->pmatch[n].rm_eo-v->pmatch[n].rm_so;
998+
brstring=v->start+v->pmatch[n].rm_so;
999+
brlen=v->pmatch[n].rm_eo-v->pmatch[n].rm_so;
9991000

10001001
/* no room to maneuver -- retries are pointless */
10011002
if (v->mem[t->retry])
10021003
returnREG_NOMATCH;
10031004
v->mem[t->retry]=1;
10041005

1005-
/* special-case zero-length string */
1006-
if (len==0)
1006+
/* special cases for zero-length strings */
1007+
if (brlen==0)
1008+
{
1009+
/*
1010+
* matches only if target is zero length, but any number of
1011+
* repetitions can be considered to be present
1012+
*/
1013+
if (begin==end&&min <=max)
1014+
{
1015+
MDEBUG(("cbackref matched trivially\n"));
1016+
returnREG_OKAY;
1017+
}
1018+
returnREG_NOMATCH;
1019+
}
1020+
if (begin==end)
10071021
{
1008-
if (begin==end)
1022+
/* matches only if zero repetitions are okay */
1023+
if (min==0)
1024+
{
1025+
MDEBUG(("cbackref matched trivially\n"));
10091026
returnREG_OKAY;
1027+
}
10101028
returnREG_NOMATCH;
10111029
}
10121030

1013-
/* and too-short string */
1014-
assert(end >=begin);
1015-
if ((size_t) (end-begin)<len)
1031+
/*
1032+
* check target length to see if it could possibly be an allowed number of
1033+
* repetitions of brstring
1034+
*/
1035+
assert(end>begin);
1036+
tlen=end-begin;
1037+
if (tlen %brlen!=0)
1038+
returnREG_NOMATCH;
1039+
numreps=tlen /brlen;
1040+
if (numreps<min|| (numreps>max&&max!=INFINITY))
10161041
returnREG_NOMATCH;
1017-
stop=end-len;
10181042

1019-
/*count occurrences */
1020-
i=0;
1021-
for (p=begin;p <=stop&& (i<max||max==INFINITY);p+=len)
1043+
/*okay, compare the actual string contents */
1044+
p=begin;
1045+
while (numreps-->0)
10221046
{
1023-
if ((*v->g->compare) (paren,p,len)!=0)
1024-
break;
1025-
i++;
1047+
if ((*v->g->compare) (brstring,p,brlen)!=0)
1048+
returnREG_NOMATCH;
1049+
p+=brlen;
10261050
}
1027-
MDEBUG(("cbackref found %d\n",i));
10281051

1029-
/* and sort it out */
1030-
if (p!=end)/* didn't consume all of it */
1031-
returnREG_NOMATCH;
1032-
if (min <=i&& (i <=max||max==INFINITY))
1033-
returnREG_OKAY;
1034-
returnREG_NOMATCH;/* out of range */
1052+
MDEBUG(("cbackref matched\n"));
1053+
returnREG_OKAY;
10351054
}
10361055

10371056
/*

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp