about summary refs log tree commit diff
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2009-08-23 15:22:00 -0700
committerUlrich Drepper <drepper@redhat.com>2009-08-23 15:22:00 -0700
commit52db8039f54672abe6a6da5fb107fa52aca42547 (patch)
tree4498b3bc09bfb3a25869ccbd6a6b09cb57bbb2e5
parentbdc7f5d76b4f284475595dddc79f0e0f9720ec20 (diff)
downloadglibc-52db8039f54672abe6a6da5fb107fa52aca42547.tar.gz
glibc-52db8039f54672abe6a6da5fb107fa52aca42547.tar.xz
glibc-52db8039f54672abe6a6da5fb107fa52aca42547.zip
Recognize ill-formed { } expressions in regcomp.
-rw-r--r--ChangeLog3
-rw-r--r--posix/regcomp.c2
2 files changed, 4 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index a42e20b0be..37cd868c19 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2009-08-23  Ulrich Drepper  <drepper@redhat.com>
 
+	* posix/regcomp.c (parse_dup_op): Verify the expression is correctly
+	terminated.
+
 	* posix/unistd.h: Define _POSIX_VERSION and _POSIX2_* correctly if
 	older POSIX versions are selected.
 
diff --git a/posix/regcomp.c b/posix/regcomp.c
index 4843cfea33..446fed5445 100644
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -2481,7 +2481,7 @@ parse_dup_op (bin_tree_t *elem, re_string_t *regexp, re_dfa_t *dfa,
 	  return elem;
 	}
 
-      if (BE (end != -1 && start > end, 0))
+      if (BE ((end != -1 && start > end) || token->type != OP_CLOSE_DUP_NUM, 0))
 	{
 	  /* First number greater than second.  */
 	  *err = REG_BADBR;