mirror of
https://github.com/opnsense/src.git
synced 2026-02-14 08:13:38 -05:00
When passed the invalid regular expression "a**", the error is eventually detected and seterr() is called. It sets p->error appropriatly and p->next and p->end to nuls which is a never used char nuls[10] which is zeros due to .bss initialization. Unfortunatly, p_ere_exp() and p_simp_re() both have fall through cases where they set the error, decrement p->next and access it which means a read from what ever .bss variable comes before nuls. Found with regex_test:repet_multi and CHERI bounds checking. Reviewed by: ngie, pfg, emaste Obtained from: CheriBSD Sponsored by: DARPA, AFRL MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D10541 |
||
|---|---|---|
| .. | ||
| grot | ||
| cname.h | ||
| COPYRIGHT | ||
| engine.c | ||
| Makefile.inc | ||
| re_format.7 | ||
| regcomp.c | ||
| regerror.c | ||
| regex.3 | ||
| regex2.h | ||
| regexec.c | ||
| regfree.c | ||
| Symbol.map | ||
| utils.h | ||
| WHATSNEW | ||