From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 7669D3851C0C; Sat, 23 May 2020 07:54:36 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7669D3851C0C From: "mbuilov at gmail dot com" To: glibc-bugs-regex@sourceware.org Subject: [Bug regex/26026] New: __wcrtomb called with undefined conversion state Date: Sat, 23 May 2020 07:54:36 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: glibc X-Bugzilla-Component: regex X-Bugzilla-Version: 2.33 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: mbuilov at gmail dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: glibc-bugs-regex@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Glibc-bugs-regex mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 May 2020 07:54:36 -0000 https://sourceware.org/bugzilla/show_bug.cgi?id=3D26026 Bug ID: 26026 Summary: __wcrtomb called with undefined conversion state Product: glibc Version: 2.33 Status: UNCONFIRMED Severity: normal Priority: P2 Component: regex Assignee: unassigned at sourceware dot org Reporter: mbuilov at gmail dot com CC: drepper.fsp at gmail dot com Target Milestone: --- Hi. Please consider the following code fragment of ./posix/regcomp.c: 392 /* ... Else catch all bytes which can start the mbchars.= */ 393 for (i =3D 0; i < cset->nmbchars; ++i) 394 { 395 char buf[256]; 396 mbstate_t state; 397 memset (&state, '\0', sizeof (state)); 398 if (__wcrtomb (buf, cset->mbchars[i], &state) !=3D (size_t) -1) 399 re_set_fastmap (fastmap, icase, *(unsigned char *) buf); here, if __wcrtomb() fails, the variable 'state' becomes "undefined". 400 if ((bufp->syntax & RE_ICASE) && dfa->mb_cur_max > 1) 401 { 402 if (__wcrtomb (buf, __towlower (cset->mbchars[i]= ), &state) 403 !=3D (size_t) -1) and here __wcrtomb() reuses "undefined" 'state' 404 re_set_fastmap (fastmap, false, *(unsigned cha= r *) buf); 405 } 406 } --=20 You are receiving this mail because: You are on the CC list for the bug.=