[Bug libstdc++/102447] std::regex incorrectly accepts invalid bracket expression

["cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102447

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jonathan Wakely
<redi@gcc.gnu.org>:

https://gcc.gnu.org/g:4c347b8d59958d5aa76c5fdcecd72478e08c5aa3

commit r10-11465-g4c347b8d59958d5aa76c5fdcecd72478e08c5aa3
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Tue Dec 14 14:32:35 2021 +0000

    libstdc++: Fix handling of invalid ranges in std::regex [PR102447]

    std::regex currently allows invalid bracket ranges such as [\w-a] which
    are only allowed by ECMAScript when in web browser compatibility mode.
    It should be an error, because the start of the range is a character
    class, not a single character. The current implementation of
    _Compiler::_M_expression_term does not provide a way to reject this,
    because we only remember a previous character, not whether we just
    processed a character class (or collating symbol etc.)

    This patch replaces the pair<bool, CharT> used to emulate
    optional<CharT> with a custom class closer to pair<tribool,CharT>. That
    allows us to track three states, so that we can tell when we've just
    seen a character class.

    With this additional state the code in _M_expression_term for processing
    the _S_token_bracket_dash can be improved to correctly reject the [\w-a]
    case, without regressing for valid cases such as [\w-] and [----].

    libstdc++-v3/ChangeLog:

            PR libstdc++/102447
            * include/bits/regex_compiler.h (_Compiler::_BracketState): New
            class.
            (_Compiler::_BrackeyMatcher): New alias template.
            (_Compiler::_M_expression_term): Change pair<bool, CharT>
            parameter to _BracketState. Process first character for
            ECMAScript syntax as well as POSIX.
            * include/bits/regex_compiler.tcc
            (_Compiler::_M_insert_bracket_matcher): Pass _BracketState.
            (_Compiler::_M_expression_term): Use _BracketState to store
            state between calls. Improve handling of dashes in ranges.
            * testsuite/28_regex/algorithms/regex_match/cstring_bracket_01.cc:
            Add more tests for ranges containing dashes. Check invalid
            ranges with character class at the beginning.

    (cherry picked from commit 7ce3c230edf6e498e125c805a6dd313bf87dc439)