Skip to content

Fix parser out-of-bounds reads #131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
laurikari wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Fix parser out-of-bounds reads #131

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
09b5b55
Improve test_comp to run also regncomp without a NUL terminated input
laurikari Dec 28, 2025
d35a749
Add various test cases that trigger out-of-bounds read bugs in the pa…
laurikari Dec 28, 2025
71ebd5e
Replace literal bytes in test strings with hex escapes
laurikari Dec 28, 2025
87d5bb4
Fix various parser bugs where the input was referenced past the end
laurikari Dec 28, 2025
aaa4e5d
Document \Q and \E escapes
laurikari May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 73 additions & 50 deletions tests/retest.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,22 @@ wrap_regcomp(regex_t *preg, const CHAR_T *data, size_t len, int cflags)
{
#ifdef HAVE_REGNCOMP
if (use_regncomp)
return tre_regncomp(preg, data, len, cflags);
{
CHAR_T *buf = NULL;
int ret;

if (len > 0)
{
buf = xmalloc(len * sizeof(CHAR_T));
if (buf == NULL)
return REG_ESPACE;
memcpy(buf, data, len * sizeof(CHAR_T));

@dag-erling dag-erling May 15, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is likely to still be null-terminated at least some of the time. It would be better to allocate a slightly larger buffer and deliberately set the first out-of-bounds character to something non-zero.

@dag-erling dag-erling May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

static int
wrap_regcomp(regex_t *preg, const CHAR_T *data, size_t len, int cflags)
{
#ifdef HAVE_REGNCOMP
  CHAR_T *buf;
  int ret;

  if (use_regncomp)
    {
      buf = xmalloc((len + 1) * sizeof(CHAR_T));
      if (buf == NULL)
	return REG_ESPACE;
      memcpy(buf, data, len * sizeof(CHAR_T));
      buf[len] = (CHAR_T)~0;
      ret = tre_regncomp(preg, buf, len, cflags);
      xfree(buf);
      return ret;
    }
#endif /* HAVE_REGNCOMP */
  return tre_regcomp(preg, data, cflags);
}

}

ret = tre_regncomp(preg, buf ? buf : data, len, cflags);
xfree(buf);
return ret;
}
else
return tre_regcomp(preg, data, cflags);
#else /* !HAVE_REGNCOMP */
Expand Down Expand Up @@ -500,79 +515,87 @@ test_exec(const char *str, int eflags, ...)
static void
test_comp(const char *re, int flags, int ret)
{
int errcode = 0;
int len = re ? strlen(re) : 0;
int use_regncomp_value;

if (valid_reobj)
for (use_regncomp_value = 0; use_regncomp_value <= 1; use_regncomp_value++)
{
tre_regfree(&reobj);
valid_reobj = 0;
}
int errcode = 0;
int len = re ? strlen(re) : 0;

comp_tests++;
if (valid_reobj)
{
tre_regfree(&reobj);
valid_reobj = 0;
}

#ifdef WRETEST
{
int wlen = mbntowc(wregex, re, len, NULL);
comp_tests++;
use_regncomp = use_regncomp_value;

if (wlen < 0)
#ifdef WRETEST
{
comp_errors++;
fprintf(outf, "Invalid or incomplete multi-byte sequence in %s\n", re);
return;
int wlen = mbntowc(wregex, re, len, NULL);

if (wlen < 0)
{
comp_errors++;
fprintf(outf, "Invalid or incomplete multi-byte sequence in %s\n", re);
return;
}
wregex[wlen] = L'\0';
len = wlen;
}
wregex[wlen] = L'\0';
len = wlen;
}
#define re wregex
#endif /* WRETEST */
regex_pattern = re;
cflags_global = flags;
regex_pattern = re;
cflags_global = flags;

#ifdef MALLOC_DEBUGGING
xmalloc_configure(-1);
if (ret != REG_ESPACE) {
static int j = 0;
int i = 0;
while (1)
{
xmalloc_configure(i);
comp_tests++;
if (j++ % 20 == 0)
test_status('.');
errcode = wrap_regcomp(&reobj, re, len, flags);
if (errcode != REG_ESPACE)
{
test_status('*');
break;
}
xmalloc_configure(-1);
if (ret != REG_ESPACE) {
static int j = 0;
int i = 0;
while (1)
{
xmalloc_configure(i);
comp_tests++;
if (j++ % 20 == 0)
test_status('.');
errcode = wrap_regcomp(&reobj, re, len, flags);
if (errcode != REG_ESPACE)
{
test_status('*');
break;
}
#ifdef REGEX_DEBUG
xmalloc_dump_leaks();
xmalloc_dump_leaks();
#endif /* REGEX_DEBUG */
i++;
}
} else
i++;
}
} else
#endif /* !MALLOC_DEBUGGING */
errcode = wrap_regcomp(&reobj, re, len, flags);
errcode = wrap_regcomp(&reobj, re, len, flags);

#ifdef WRETEST
#undef re
#endif /* WRETEST */

if (errcode != ret)
{
if (errcode != ret)
{
#ifndef WRETEST
fprintf(outf, "Comp error, regex: \"%s\"\n", regex_pattern);
fprintf(outf, "Comp error, regex: \"%s\"\n", regex_pattern);
#else /* WRETEST */
fprintf(outf, "Comp error, regex: \"%ls\"\n", regex_pattern);
fprintf(outf, "Comp error, regex: \"%ls\"\n", regex_pattern);
#endif /* WRETEST */
fprintf(outf, " expected return code %d, got %d.\n",
ret, errcode);
comp_errors++;
fprintf(outf, " expected return code %d, got %d.\n",
ret, errcode);
comp_errors++;
}

if (errcode == 0)
valid_reobj = 1;
}

if (errcode == 0)
valid_reobj = 1;
use_regncomp = 0;
}


Expand Down