This is the mail archive of the libc-hacker@sources.redhat.com mailing list for the glibc project.
Note that libc-hacker is a closed list. You may look at the archives of this list, but subscription and posting are not open.
| Index Nav: | [Date Index] [Subject Index] [Author Index] [Thread Index] | |
|---|---|---|
| Message Nav: | [Date Prev] [Date Next] | [Thread Prev] [Thread Next] |
| Other format: | [Raw text] | |
regcomp is accessing arrays outside their bounds.
Andreas.
2004-02-06 Andreas Schwab <schwab@suse.de>
* posix/regcomp.c (build_range_exp): Fix off-by-one.
(parse_bracket_exp): Likewise.
Index: posix/regcomp.c
===================================================================
RCS file: /cvs/glibc/libc/posix/regcomp.c,v
retrieving revision 1.77
diff -u -p -a -u -p -a -r1.77 posix/regcomp.c
--- posix/regcomp.c 30 Jan 2004 05:19:45 -0000 1.77
+++ posix/regcomp.c 6 Feb 2004 15:04:44 -0000
@@ -2603,7 +2603,7 @@ build_range_exp (sbcset, start_elem, end
}
/* Build the table for single byte characters. */
- for (wc = 0; wc <= SBC_MAX; ++wc)
+ for (wc = 0; wc < SBC_MAX; ++wc)
{
cmp_buf[2] = wc;
if (wcscoll (cmp_buf, cmp_buf + 2) <= 0
@@ -2623,7 +2623,7 @@ build_range_exp (sbcset, start_elem, end
if (start_ch > end_ch)
return REG_ERANGE;
/* Build the table for single byte characters. */
- for (ch = 0; ch <= SBC_MAX; ++ch)
+ for (ch = 0; ch < SBC_MAX; ++ch)
if (start_ch <= ch && ch <= end_ch)
bitset_set (sbcset, ch);
}
@@ -2846,7 +2846,7 @@ parse_bracket_exp (regexp, dfa, token, s
}
/* Build the table for single byte characters. */
- for (ch = 0; ch <= SBC_MAX; ch++)
+ for (ch = 0; ch < SBC_MAX; ch++)
{
uint32_t ch_collseq;
/*
--
Andreas Schwab, SuSE Labs, schwab@suse.de
SuSE Linux AG, Maxfeldstraße 5, 90409 Nürnberg, Germany
Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5
"And now for something completely different."
| Index Nav: | [Date Index] [Subject Index] [Author Index] [Thread Index] | |
|---|---|---|
| Message Nav: | [Date Prev] [Date Next] | [Thread Prev] [Thread Next] |