This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]
Other format:	[Raw text]

Re: [PATCH] Fix buffer overrun in regexp matcher

From: Andreas Schwab <schwab at suse dot de>
To: Carlos O'Donell <carlos at systemhalted dot org>
Cc: libc-alpha at sourceware dot org
Date: Thu, 31 Jan 2013 09:33:03 +0100
Subject: Re: [PATCH] Fix buffer overrun in regexp matcher
References: <mvma9rsq85s.fsf@hawking.suse.de><5109F6A6.9020801@systemhalted.org>

Carlos O'Donell <carlos@systemhalted.org> writes:

> Thus MIN() never yields anything near double the length.

That is not true, otherwise the bug would not have happend.  bufs_len
starts out pretty small (MB_CUR_MAX).

> ret = re_string_realloc_buffers (pstr, min_len);
>
> Why wouldn't that just work?

It would work, but also causes a lot more reallocs since many uses go by
single steps.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."

References:
- [PATCH] Fix buffer overrun in regexp matcher
  - From: Andreas Schwab
- Re: [PATCH] Fix buffer overrun in regexp matcher
  - From: Carlos O'Donell

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]