diff options
| author | Andreas Schwab <schwab@linux-m68k.org> | 2014-06-20 12:41:27 +0200 |
|---|---|---|
| committer | Allan McRae <allan@archlinux.org> | 2014-09-05 22:44:09 +1000 |
| commit | 2ce47f454b6f1df5d2374fcac1b72e65e5f55a67 (patch) | |
| tree | 03ffe4486370b40f839609a8d344eb3b818cd8d1 | |
| parent | 1f542fe398a1d02cce53d78f7a33e72078e7d4e9 (diff) | |
| download | glibc-2ce47f454b6f1df5d2374fcac1b72e65e5f55a67.tar.gz glibc-2ce47f454b6f1df5d2374fcac1b72e65e5f55a67.tar.xz glibc-2ce47f454b6f1df5d2374fcac1b72e65e5f55a67.zip | |
Fix another memory leak in regexp compiler (BZ #17069)
(cherry picked from commit aa6ec754f3b4b1df81d186480c534b6486a1e6ee) Conflicts: NEWS
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | posix/bug-regex36.c | 4 | ||||
| -rw-r--r-- | posix/regcomp.c | 6 |
4 files changed, 15 insertions, 4 deletions
diff --git a/ChangeLog b/ChangeLog index 8dd7e30c5e..816f536bcb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2014-06-20 Andreas Schwab <schwab@linux-m68k.org> + + [BZ #17069] + * posix/regcomp.c (parse_reg_exp): Deallocate partially + constructed tree before returning error. + * posix/bug-regexp36.c: Expand test case. + 2014-06-19 Andreas Schwab <schwab@linux-m68k.org> [BZ #17069] diff --git a/NEWS b/NEWS index 4eebd67611..3f762d1ffb 100644 --- a/NEWS +++ b/NEWS @@ -10,7 +10,7 @@ Version 2.19.1 * The following bugs are resolved with this release: 15946, 16545, 16574, 16623, 16882, 16885, 16916, 16932, 16943, 16958, - 17048. + 17048, 17069. * CVE-2014-4043 The posix_spawn_file_actions_addopen implementation did not copy the path argument. This allowed programs to cause posix_spawn to diff --git a/posix/bug-regex36.c b/posix/bug-regex36.c index 3dda026585..59e2b6d321 100644 --- a/posix/bug-regex36.c +++ b/posix/bug-regex36.c @@ -1,4 +1,4 @@ -/* Test regcomp not leaking memory on invalid repetition operator +/* Test regcomp not leaking memory on parse errors Copyright (C) 2014 Free Software Foundation, Inc. This file is part of the GNU C Library. @@ -24,6 +24,6 @@ main (int argc, char **argv) { regex_t r; mtrace (); - regcomp (&r, "[a]\\{-2,}", 0); + regcomp (&r, "[a]\\|[a]\\{-2,}", 0); regfree (&r); } diff --git a/posix/regcomp.c b/posix/regcomp.c index a5020be192..076eca3e7c 100644 --- a/posix/regcomp.c +++ b/posix/regcomp.c @@ -2154,7 +2154,11 @@ parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token, { branch = parse_branch (regexp, preg, token, syntax, nest, err); if (BE (*err != REG_NOERROR && branch == NULL, 0)) - return NULL; + { + if (tree != NULL) + postorder (tree, free_tree, NULL); + return NULL; + } } else branch = NULL; |