diff options
author | Daniel C. Sobral <dcs@FreeBSD.org> | 2001-11-09 10:17:44 +0000 |
---|---|---|
committer | Daniel C. Sobral <dcs@FreeBSD.org> | 2001-11-09 10:17:44 +0000 |
commit | 8e2f75b833b447b74f8b5c5c987c67e1cccfd43a (patch) | |
tree | abf0494275d04c813176e71df06a77429eaeb1f7 /lib/libc/regex | |
parent | 93da209126573e7ee340cc08496af47805eef3ed (diff) | |
download | src-8e2f75b833b447b74f8b5c5c987c67e1cccfd43a.tar.gz src-8e2f75b833b447b74f8b5c5c987c67e1cccfd43a.zip |
The algorithm that computes the tables used in the BM search algorithm sometimes
access an array beyond it's length. This only happens in the last iteration of
a loop, and the value fetched is not used then, so the bug is a relatively
innocent one. Fix this by not fetching any value on the last iteration of said
loop.
Submitted by: MKI <mki@mozone.net>
MFC after: 1 week
Notes
Notes:
svn path=/head/; revision=86208
Diffstat (limited to 'lib/libc/regex')
-rw-r--r-- | lib/libc/regex/regcomp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/libc/regex/regcomp.c b/lib/libc/regex/regcomp.c index bf92f2c07460..602ddb01333e 100644 --- a/lib/libc/regex/regcomp.c +++ b/lib/libc/regex/regcomp.c @@ -2045,7 +2045,8 @@ struct re_guts *g; g->mlen + ssuffix - suffix); suffix++; } - ssuffix = pmatches[ssuffix]; + if (suffix < g->mlen) + ssuffix = pmatches[ssuffix]; } free(pmatches); |