From 3ae9d4db47a942f7330ce69f954c8a2b58177236 Mon Sep 17 00:00:00 2001
From: Tom Lane <tgl@sss.pgh.pa.us>
Date: Wed, 27 Feb 2013 10:40:10 -0500
Subject: [PATCH] Add missing error check in regexp parser.
parseqatom() failed to check for an error return (NULL result) from its
recursive call to parsebranch(), and in consequence could crash with a
null-pointer dereference after an error return. This bug has been there
since day one, but wasn't noticed before, probably because most error cases
in parsebranch() didn't actually lead to returning NULL. Add the missing
error check, and also tweak parsebranch() to exit in a less indirect
fashion after a call to parseqatom() fails.
Report by Tomasz Karlik, fix by me.
---
src/backend/regex/regcomp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c
index 5c5a9a8cd2d..9b3fe64807e 100644
--- a/src/backend/regex/regcomp.c
+++ b/src/backend/regex/regcomp.c
@@ -712,6 +712,7 @@ parsebranch(struct vars * v,
/* NB, recursion in parseqatom() may swallow rest of branch */
parseqatom(v, stopper, type, lp, right, t);
+ NOERRN();
}
if (!seencontent)
@@ -1169,6 +1170,7 @@ parseqatom(struct vars * v,
EMPTYARC(s2, rp);
t->right = subre(v, '=', 0, s2, rp);
}
+ NOERR();
assert(SEE('|') || SEE(stopper) || SEE(EOS));
t->flags |= COMBINE(t->flags, t->right->flags);
top->flags |= COMBINE(top->flags, t->flags);
--
GitLab