[Bug regex/15078] New: regex crash on myanmar script

[Bug regex/15078] New: regex crash on myanmar script

[bonzini at gnu dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15078

             Bug #: 15078
           Summary: regex crash on myanmar script
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: regex
        AssignedTo: unassigned@sourceware.org
        ReportedBy: bonzini@gnu.org
                CC: drepper.fsp@gmail.com
    Classification: Unclassified


Reported to upstream sed via bug-gnu-utils@gnu.org.

$ echo ကျွန်ုပ် | sed 's/[^x]x//'
*** glibc detected *** sed: free(): invalid next size (fast):
0x0000000000c4d400 ***

Same result for

$ echo ကျွန်ုပ်x | grep '[^x]x'

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug regex/15078] regex crash on myanmar script

[bonzini at gnu dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15078

--- Comment #1 from Paolo Bonzini <bonzini at gnu dot org> 2013-01-30 10:17:41 UTC ---
valgrind complains:

==10965== Invalid write of size 8
==10965==    at 0x35F8689563: __GI_memset (in /usr/lib64/libc-2.16.so)
==10965==    by 0x35F86CA636: clean_state_log_if_needed (in
/usr/lib64/libc-2.16.so)
==10965==    by 0x35F86D60C6: re_search_internal (in /usr/lib64/libc-2.16.so)
==10965==    by 0x35F86D67E4: re_search_stub (in /usr/lib64/libc-2.16.so)
==10965==    by 0x35F86D7087: re_search (in /usr/lib64/libc-2.16.so)
==10965==    by 0x407B3A: match_regex (regexp.c:252)
==10965==    by 0x406AFB: execute_program (execute.c:1189)
==10965==    by 0x4077BF: process_files (execute.c:1857)
==10965==    by 0x402496: main (sed.c:366)
==10965==  Address 0x4c47fb8 is 0 bytes after a block of size 104 alloc'd
==10965==    at 0x4A08A2E: realloc (vg_replace_malloc.c:662)
==10965==    by 0x35F86CA4B2: extend_buffers (in /usr/lib64/libc-2.16.so)
==10965==    by 0x35F86CA5D2: clean_state_log_if_needed (in
/usr/lib64/libc-2.16.so)
==10965==    by 0x35F86D60C6: re_search_internal (in /usr/lib64/libc-2.16.so)
==10965==    by 0x35F86D67E4: re_search_stub (in /usr/lib64/libc-2.16.so)
==10965==    by 0x35F86D7087: re_search (in /usr/lib64/libc-2.16.so)
==10965==    by 0x407B3A: match_regex (regexp.c:252)
==10965==    by 0x406AFB: execute_program (execute.c:1189)
==10965==    by 0x4077BF: process_files (execute.c:1857)
==10965==    by 0x402496: main (sed.c:366)
==10965==

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug regex/15078] regex crash on myanmar script

[carlos at systemhalted dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15078

Carlos O'Donell <carlos at systemhalted dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |carlos at systemhalted dot
                   |                            |org

--- Comment #2 from Carlos O'Donell <carlos at systemhalted dot org> 2013-01-30 16:19:46 UTC ---
Confirmed fails on master as of 2013-01-30.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug regex/15078] regex crash on myanmar script

[carlos at systemhalted dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15078

--- Comment #3 from Carlos O'Donell <carlos at systemhalted dot org> 2013-01-30 18:29:03 UTC ---
I'm reviewing Andreas' patch:
http://sourceware.org/ml/libc-alpha/2013-01/msg00967.html

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug regex/15078] regex crash on myanmar script

[schwab@linux-m68k.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15078

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED
   Target Milestone|---                         |2.18

--- Comment #4 from Andreas Schwab <schwab@linux-m68k.org> 2013-02-12 08:32:30 UTC ---
Fixed in 2.18.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug regex/15078] regex crash on myanmar script

[jackie.rosen at hushmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=15078

Jackie Rosen <jackie.rosen at hushmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jackie.rosen at hushmail dot com

--- Comment #5 from Jackie Rosen <jackie.rosen at hushmail dot com> ---
*** Bug 260998 has been marked as a duplicate of this bug. ***
Seen from the domain http://volichat.com
Page where seen: http://volichat.com/adult-chat-rooms
Marked for reference. Resolved as fixed @bugzilla.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug regex/15078] regex crash on myanmar script

[schwab at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=15078

Andreas Schwab <schwab at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|jackie.rosen at hushmail dot com   |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug regex/15078] regex crash on myanmar script

[schwab at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=15078

Andreas Schwab <schwab at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|jackie.rosen at hushmail dot com   |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug regex/15078] regex crash on myanmar script (CVE-2013-0242)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=15078

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
            Summary|regex crash on myanmar      |regex crash on myanmar
                   |script                      |script (CVE-2013-0242)
              Alias|                            |CVE-2013-0242
              Flags|                            |security+

-- 
You are receiving this mail because:
You are on the CC list for the bug.