regexec.c: avoid overflow in computing sum of lengths

gcm3651 · Jan 22, 2010 · 42a2c9b · 42a2c9b
1 parent eadc09f
commit 42a2c9b
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -1,5 +1,9 @@
 2010-01-22  Jim Meyering  <[email protected]>
 
+	[BZ #11191]
+	* posix/regexec.c (re_search_2_stub): Check for overflow
+	when adding the sizes of the two strings.
+
 	[BZ #11190]
 	* posix/regexec.c (re_search_internal): Avoid overflow
 	in computing re_malloc buffer size.

diff --git a/posix/regexec.c b/posix/regexec.c
@@ -370,7 +370,7 @@ re_search_2_stub (bufp, string1, length1, string2, length2, start, range, regs,
   int len = length1 + length2;
   char *s = NULL;
 
-  if (BE (length1 < 0 || length2 < 0 || stop < 0, 0))
+  if (BE (length1 < 0 || length2 < 0 || stop < 0 || len < length1, 0))
     return -2;
 
   /* Concatenate the strings.  */