about summary refs log tree commit diff
path: root/string
diff options
context:
space:
mode:
authorAndreas Schwab <schwab@redhat.com>2011-11-29 10:52:22 +0100
committerAndreas Schwab <schwab@redhat.com>2011-11-30 11:03:20 +0100
commitf3a6cc0a560a17f32a3e90d2f20501a53cab6058 (patch)
tree52085ca0dbca778c7cdf92bf0ddebe8a6727a432 /string
parentc5a0802a682dba23f92d47f0f99775aebfbe2539 (diff)
downloadglibc-f3a6cc0a560a17f32a3e90d2f20501a53cab6058.tar.gz
glibc-f3a6cc0a560a17f32a3e90d2f20501a53cab6058.tar.xz
glibc-f3a6cc0a560a17f32a3e90d2f20501a53cab6058.zip
Fix access after end of search string in regex matcher
Diffstat (limited to 'string')
-rw-r--r--string/strcoll_l.c6
-rw-r--r--string/strxfrm_l.c2
2 files changed, 4 insertions, 4 deletions
diff --git a/string/strcoll_l.c b/string/strcoll_l.c
index d8d11392e3..fb77d08238 100644
--- a/string/strcoll_l.c
+++ b/string/strcoll_l.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1995-1997,2002,2004,2007,2010 Free Software Foundation, Inc.
+/* Copyright (C) 1995-1997,2002,2004,2007,2010,2011 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Written by Ulrich Drepper <drepper@gnu.org>, 1995.
 
@@ -205,7 +205,7 @@ STRCOLL (s1, s2, l)
 
 		while (*us1 != L('\0'))
 		  {
-		    int32_t tmp = findidx (&us1);
+		    int32_t tmp = findidx (&us1, -1);
 		    rule1arr[idx1max] = tmp >> 24;
 		    idx1arr[idx1max] = tmp & 0xffffff;
 		    idx1cnt = idx1max++;
@@ -267,7 +267,7 @@ STRCOLL (s1, s2, l)
 
 		while (*us2 != L('\0'))
 		  {
-		    int32_t tmp = findidx (&us2);
+		    int32_t tmp = findidx (&us2, -1);
 		    rule2arr[idx2max] = tmp >> 24;
 		    idx2arr[idx2max] = tmp & 0xffffff;
 		    idx2cnt = idx2max++;
diff --git a/string/strxfrm_l.c b/string/strxfrm_l.c
index 220253c4d6..b06556dfbd 100644
--- a/string/strxfrm_l.c
+++ b/string/strxfrm_l.c
@@ -176,7 +176,7 @@ STRXFRM (STRING_TYPE *dest, const STRING_TYPE *src, size_t n, __locale_t l)
   idxmax = 0;
   do
     {
-      int32_t tmp = findidx (&usrc);
+      int32_t tmp = findidx (&usrc, -1);
       rulearr[idxmax] = tmp >> 24;
       idxarr[idxmax] = tmp & 0xffffff;