public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug regex/18041] New: infinite loop in regcomp/calc_eclosure_iter
@ 2015-02-26 22:01 konstantin.s.serebryany at gmail dot com
2015-03-02 10:37 ` [Bug regex/18041] " fweimer at redhat dot com
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: konstantin.s.serebryany at gmail dot com @ 2015-02-26 22:01 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18041
Bug ID: 18041
Summary: infinite loop in regcomp/calc_eclosure_iter
Product: glibc
Version: 2.21
Status: NEW
Severity: normal
Priority: P2
Component: regex
Assignee: unassigned at sourceware dot org
Reporter: konstantin.s.serebryany at gmail dot com
CC: drepper.fsp at gmail dot com
#include <regex.h>
int main() {
regex_t r;
const char p[] = {135, 57, 42, 92, 39, 82, 42, 42, 123, 57, 48, 125, 0};
regcomp(&r, p, 75);
return 0;
}
gcc re3.cc && ./a.out # never ends
...
#253 0x00007ffff7af3c1f in calc_eclosure_iter
(new_set=new_set@entry=0x7fffffffdb80, dfa=dfa@entry=0x602120,
node=node@entry=2, root=root@entry=1) at regcomp.c:1732
#254 0x00007ffff7af7847 in calc_eclosure (dfa=<optimized out>) at
regcomp.c:1672
#255 analyze (preg=<optimized out>) at regcomp.c:1198
#256 re_compile_internal (preg=preg@entry=0x7fffffffdc80,
pattern=pattern@entry=0x7fffffffdcc0 "\207\071*\\'R**{90}", length=<optimized
out>, syntax=syntax@entry=4436732) at regcomp.c:804
#257 0x00007ffff7af8a80 in __regcomp (preg=0x7fffffffdc80,
pattern=0x7fffffffdcc0 "\207\071*\\'R**{90}", cflags=<optimized out>) at
regcomp.c:506
#258 0x0000000000400601 in main ()
2.19 and fresh trunk are affected.
Found with the same fuzzer as bugs 18032, 18036, 18037, 18040
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug regex/18041] infinite loop in regcomp/calc_eclosure_iter
2015-02-26 22:01 [Bug regex/18041] New: infinite loop in regcomp/calc_eclosure_iter konstantin.s.serebryany at gmail dot com
@ 2015-03-02 10:37 ` fweimer at redhat dot com
2015-03-02 10:37 ` fweimer at redhat dot com
2015-03-10 22:27 ` konstantin.s.serebryany at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: fweimer at redhat dot com @ 2015-03-02 10:37 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18041
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |security-
--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
I'm flagging this as security- based on our policy for regcomp bugs:
https://sourceware.org/glibc/wiki/Security%20Exceptions
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug regex/18041] infinite loop in regcomp/calc_eclosure_iter
2015-02-26 22:01 [Bug regex/18041] New: infinite loop in regcomp/calc_eclosure_iter konstantin.s.serebryany at gmail dot com
2015-03-02 10:37 ` [Bug regex/18041] " fweimer at redhat dot com
@ 2015-03-02 10:37 ` fweimer at redhat dot com
2015-03-10 22:27 ` konstantin.s.serebryany at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: fweimer at redhat dot com @ 2015-03-02 10:37 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18041
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |fweimer at redhat dot com
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Bug regex/18041] infinite loop in regcomp/calc_eclosure_iter
2015-02-26 22:01 [Bug regex/18041] New: infinite loop in regcomp/calc_eclosure_iter konstantin.s.serebryany at gmail dot com
2015-03-02 10:37 ` [Bug regex/18041] " fweimer at redhat dot com
2015-03-02 10:37 ` fweimer at redhat dot com
@ 2015-03-10 22:27 ` konstantin.s.serebryany at gmail dot com
2 siblings, 0 replies; 4+ messages in thread
From: konstantin.s.serebryany at gmail dot com @ 2015-03-10 22:27 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18041
--- Comment #2 from Kostya Serebryany <konstantin.s.serebryany at gmail dot com> ---
Similar case. It also eats all the available RAM.
#include <regex.h>
int main() {
regex_t r;
regcomp(&r, "\\(^\\)\\{9999\\}", 0);
return 0;
}
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-03-10 22:27 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-02-26 22:01 [Bug regex/18041] New: infinite loop in regcomp/calc_eclosure_iter konstantin.s.serebryany at gmail dot com
2015-03-02 10:37 ` [Bug regex/18041] " fweimer at redhat dot com
2015-03-02 10:37 ` fweimer at redhat dot com
2015-03-10 22:27 ` konstantin.s.serebryany at gmail dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).