From d1c5218b098101b458b1362327aa5dc754eefcf2 Mon Sep 17 00:00:00 2001 From: brooks Date: Tue, 9 May 2017 16:27:20 +0000 Subject: [PATCH] MFC r317707: Correct an out-of-bounds read in regcomp when the RE is bad. When passed the invalid regular expression "a**", the error is eventually detected and seterr() is called. It sets p->error appropriatly and p->next and p->end to nuls which is a never used char nuls[10] which is zeros due to .bss initialization. Unfortunatly, p_ere_exp() and p_simp_re() both have fall through cases where they set the error, decrement p->next and access it which means a read from whatever .bss variable comes before nuls. Found with regex_test:repet_multi and CHERI bounds checking. Reviewed by: ngie, pfg, emaste Obtained from: CheriBSD Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D10541 --- lib/libc/regex/regcomp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/libc/regex/regcomp.c b/lib/libc/regex/regcomp.c index dfb02c638a4..b9e67c60b40 100644 --- a/lib/libc/regex/regcomp.c +++ b/lib/libc/regex/regcomp.c @@ -444,6 +444,8 @@ p_ere_exp(struct parse *p) (void)REQUIRE(!MORE() || !isdigit((uch)PEEK()), REG_BADRPT); /* FALLTHROUGH */ default: + if (p->error != 0) + return; p->next--; wc = WGETNEXT(); ordinary(p, wc); @@ -651,6 +653,8 @@ p_simp_re(struct parse *p, (void)REQUIRE(starordinary, REG_BADRPT); /* FALLTHROUGH */ default: + if (p->error != 0) + return(0); /* Definitely not $... */ p->next--; wc = WGETNEXT(); ordinary(p, wc); -- 2.45.0