postgres.git / summary / log / commit / refs

commit    f5185db27f53b85c1386e589d7dfd9e291f3c967
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Wed Feb 27 15:40:14 2013 +0000
First released in: 9.3.0, 8.4.17, 9.0.13, 9.1.9, 9.2.4

    Add missing error check in regexp parser.
    
    parseqatom() failed to check for an error return (NULL result) from its
    recursive call to parsebranch(), and in consequence could crash with a
    null-pointer dereference after an error return.  This bug has been there
    since day one, but wasn't noticed before, probably because most error cases
    in parsebranch() didn't actually lead to returning NULL.  Add the missing
    error check, and also tweak parsebranch() to exit in a less indirect
    fashion after a call to parseqatom() fails.
    
    Report by Tomasz Karlik, fix by me.


 src/backend/regex/regcomp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c
index 34c633a4e88..e9f2a8bfab2 100644
--- a/src/backend/regex/regcomp.c
+++ b/src/backend/regex/regcomp.c
@@ -711,6 +711,7 @@ parsebranch(struct vars * v,
 
 		/* NB, recursion in parseqatom() may swallow rest of branch */
 		parseqatom(v, stopper, type, lp, right, t);
+		NOERRN();
 	}
 
 	if (!seencontent)
@@ -1155,6 +1156,7 @@ parseqatom(struct vars * v,
 		EMPTYARC(atom->end, rp);
 		t->right = subre(v, '=', 0, atom->end, rp);
 	}
+	NOERR();
 	assert(SEE('|') || SEE(stopper) || SEE(EOS));
 	t->flags |= COMBINE(t->flags, t->right->flags);
 	top->flags |= COMBINE(top->flags, t->flags);


[parent: bd0bfe1f8081]