• Shishir Jaiswal's avatar
    Bug#24449090 - BUFFER OVERFLOW IN FUNCTION DUPL · 8f297058
    Shishir Jaiswal authored
    DESCRIPTION
    ===========
    Performing a pattern match of a Regex resulting into a very
    large string, leads to crash due to failed realloc().
    
    ANALYSIS
    ========
    dupl() calls enlarge(). It in turn calls realloc() for
    pointer p->strip. This eventually fails due to OOM.
    However we are still using the same pointer in memcpy()
    causing a SEGFAULT!
    
    FIX
    ===
    1) In dupl(), checking for error code (which would be set
    if realloc fails) immediately after call to enlarge().
    Returning now with this error code.
    
    2) Handling the same in the caller functions.
    8f297058
regcomp.c 39 KB