HomeFreeBSD

Fix out-of-bounds read in libc/regex.

Description

Fix out-of-bounds read in libc/regex.

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

MFC after: 1 week
Obtained from: Vlad Tsyrklevich through posting on openbsd-tech

Details

Provenance
pfgAuthored on
Parents
rS325065: Split the hardware type enum and the hw feature flags bits into separate
Branches
Unknown
Tags
Unknown