about summary refs log tree commit diff
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@gmail.com>2010-10-11 11:46:22 -0400
committerUlrich Drepper <drepper@gmail.com>2010-10-11 11:46:22 -0400
commita129c80d54ec951567caa8c1b042275422d5f367 (patch)
tree1ed6df786f2883d65f45461a431c6041f002dbef
parentb76b818e6fe2061e778b3a9bbe63c554c3f9b3c1 (diff)
downloadglibc-a129c80d54ec951567caa8c1b042275422d5f367.tar.gz
glibc-a129c80d54ec951567caa8c1b042275422d5f367.tar.xz
glibc-a129c80d54ec951567caa8c1b042275422d5f367.zip
Fix memory leak for some invalid regular expressions.
-rw-r--r--ChangeLog5
-rw-r--r--NEWS2
-rw-r--r--posix/regcomp.c10
3 files changed, 15 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index bc6cfa79e7..15b47f9049 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
 2010-10-11  Ulrich Drepper  <drepper@gmail.com>
 
+	* posix/regcomp.c (parse_bracket_exp): Add missing re_free calls.
+
+	[BZ #12078]
+	* posix/regcomp.c (parse_sub_exp): Free tree data when it is not used.
+
 	[BZ #12108]
 	* stdio-common/psiginfo.c (psiginfo): Don't expext SIGRTMIN..SIGRTMAX
 	to have entries in sys_siglist.
diff --git a/NEWS b/NEWS
index fcb1b57b55..bd0f21c451 100644
--- a/NEWS
+++ b/NEWS
@@ -10,7 +10,7 @@ Version 2.13
 * The following bugs are resolved with this release:
 
   3268, 7066, 10851, 11611, 11640, 11701, 11840, 11856, 11883, 11903, 11904,
-  11968, 11979, 12005, 12037, 12067, 12077, 12092, 12093, 12107, 12108
+  11968, 11979, 12005, 12037, 12067, 12077, 12078, 12092, 12093, 12107, 12108
 
 * New Linux interfaces: prlimit, prlimit64, fanotify_init, fanotify_mark
 
diff --git a/posix/regcomp.c b/posix/regcomp.c
index 03ab123907..9f5ca2cd0e 100644
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -2418,7 +2418,11 @@ parse_sub_exp (re_string_t *regexp, regex_t *preg, re_token_t *token,
     {
       tree = parse_reg_exp (regexp, preg, token, syntax, nest, err);
       if (BE (*err == REG_NOERROR && token->type != OP_CLOSE_SUBEXP, 0))
-	*err = REG_EPAREN;
+	{
+	  if (tree != NULL)
+	    free_tree (NULL, tree);
+	  *err = REG_EPAREN;
+	}
       if (BE (*err != REG_NOERROR, 0))
 	return NULL;
     }
@@ -3028,6 +3032,10 @@ parse_bracket_exp (re_string_t *regexp, re_dfa_t *dfa, re_token_t *token,
   if (BE (sbcset == NULL, 0))
 #endif /* RE_ENABLE_I18N */
     {
+      re_free (sbcset);
+#ifdef RE_ENABLE_I18N
+      re_free (mbcset);
+#endif
       *err = REG_ESPACE;
       return NULL;
     }