From f3a6cc0a560a17f32a3e90d2f20501a53cab6058 Mon Sep 17 00:00:00 2001 From: Andreas Schwab Date: Tue, 29 Nov 2011 10:52:22 +0100 Subject: Fix access after end of search string in regex matcher --- posix/regcomp.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'posix/regcomp.c') diff --git a/posix/regcomp.c b/posix/regcomp.c index b238c08225..34ee845081 100644 --- a/posix/regcomp.c +++ b/posix/regcomp.c @@ -1,5 +1,5 @@ /* Extended regular expression matching and search library. - Copyright (C) 2002-2007,2009,2010 Free Software Foundation, Inc. + Copyright (C) 2002-2007,2009,2010,2011 Free Software Foundation, Inc. This file is part of the GNU C Library. Contributed by Isamu Hasegawa . @@ -3409,19 +3409,18 @@ build_equiv_class (bitset_t sbcset, const unsigned char *name) _NL_COLLATE_EXTRAMB); indirect = (const int32_t *) _NL_CURRENT (LC_COLLATE, _NL_COLLATE_INDIRECTMB); - idx1 = findidx (&cp); - if (BE (idx1 == 0 || cp < name + strlen ((const char *) name), 0)) + idx1 = findidx (&cp, -1); + if (BE (idx1 == 0 || *cp != '\0', 0)) /* This isn't a valid character. */ return REG_ECOLLATE; /* Build single byte matcing table for this equivalence class. */ - char_buf[1] = (unsigned char) '\0'; len = weights[idx1 & 0xffffff]; for (ch = 0; ch < SBC_MAX; ++ch) { char_buf[0] = ch; cp = char_buf; - idx2 = findidx (&cp); + idx2 = findidx (&cp, 1); /* idx2 = table[ch]; */ -- cgit v1.2.3