Skip to content

Commit c96939e

Browse files
author
Karl Williamson
committed
PATCH: [perl #116899]: jump on uninitialised value
The culprit had nothing to do really with the accuesed commit. The function S_cl_or() tries to take the union of the code points matched by its two inputs. Both of those nodes must be ANYOF-like (for bracketed character classes and synthetic start classes). These come in two flavors, one having extra fields in the struct after the other one's. That is used for locale ANYOFs and the synthetic start class. The first paramter to cl_or() is always one of these extended ANYOFS, but the second parameter may be the shorter form The function was failing to check if the second one was the longer form before reading data from beyond the short-form's struct. This could cause a segfault, but that wasn't the symptom here. Instead it copied that data to the other paramter's struct. valgrind had set that data to indicate it was uninitialized, so when later it was accessed, we got this error. During much of the 5.17 series until the failing commit, more ANYOF nodes were the larger size. I presume that is why this commit showed up the problem.
1 parent ff4fdc7 commit c96939e

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

regcomp.c

+3-1
Original file line numberDiff line numberDiff line change
@@ -1028,7 +1028,9 @@ S_cl_or(const RExC_state_t *pRExC_state, struct regnode_charclass_class *cl, con
10281028
/* OR char bitmap and class bitmap separately */
10291029
for (i = 0; i < ANYOF_BITMAP_SIZE; i++)
10301030
cl->bitmap[i] |= or_with->bitmap[i];
1031-
ANYOF_CLASS_OR(or_with, cl);
1031+
if (or_with->flags & ANYOF_CLASS) {
1032+
ANYOF_CLASS_OR(or_with, cl);
1033+
}
10321034
}
10331035
else { /* XXXX: logic is complicated, leave it along for a moment. */
10341036
cl_anything(pRExC_state, cl);

0 commit comments

Comments
 (0)