[Bug regex/16749] New: segfault in regfree

[Bug regex/16749] New: segfault in regfree

[octo.nebula at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16749

            Bug ID: 16749
           Summary: segfault in regfree
           Product: glibc
           Version: 2.19
            Status: NEW
          Severity: critical
          Priority: P2
         Component: regex
          Assignee: unassigned at sourceware dot org
          Reporter: octo.nebula at gmail dot com
                CC: drepper.fsp at gmail dot com

When I run this sample program:

#include <regex.h>
#include <stdio.h>

int main()
{
  regex_t regex;
  regmatch_t matches[3];
  int status;

  status = regcomp(&regex, "(ello)", REG_EXTENDED);
  if (status != 0) {
    fprintf(stderr, "invalid regex\n");
    return 1;
  }

  status = regexec(&regex, "Hello, world!", sizeof matches, matches, 0);
  if (status != 0)
    fprintf(stderr, "Match failed\n");
  else
    printf("Matched range is %d,%d\n", matches[1].rm_so, matches[1].rm_eo);

  regfree(&regex);
  return 0;
}

And compile with:
gcc -g3 -Wall -Wextra -ore re.c

With gdb I get the SIGSEGV on regfree():

(gdb) run
Starting program: /home/sun/source/re 
Matched range is 1,5

Program received signal SIGSEGV, Segmentation fault.
0xb7ecd0a9 in free_dfa_content () from /usr/lib/libc.so.6
(gdb) bt
#0  0xb7ecd0a9 in free_dfa_content () from /usr/lib/libc.so.6
#1  0xb7ed8b2f in regfree () from /usr/lib/libc.so.6
#2  0x0804864f in main () at re.c:23


There is nothing wrong with the regex match, as you can see it succeeds without
any problems.

What is the problem with regfree?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug regex/16749] segfault in regfree

[octo.nebula at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16749

Sunny <octo.nebula at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |octo.nebula at gmail dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug regex/16749] segfault in regfree

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=16749

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |INVALID

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
nmatch is the number of elements in matches, not its size.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug regex/16749] segfault in regfree

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=16749

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.