There was another bug, that made nearly all tests fail when
run under valgrind or with ASAN-enabled binaries.
Here's the patch:
From fd5c93d580ffe8d27cadeb829600db974464437f Mon Sep 17 00:00:00 2001
From: Jim Meyering <[email protected]>
Date: Thu, 29 May 2014 09:44:41 -0700
Subject: [PATCH] dfa: fix off-by-one under-allocation from recent change

Commit v2.19-10-gc32ff67 mistakenly made this change:
  -realloc_trans_if_necessary (d, 1);
  +realloc_trans_if_necessary (d, 0);
which led to a heap buffer overflow.
* src/dfa.c (dfaexec): Allocate space for one state, as before.
---
 src/dfa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/dfa.c b/src/dfa.c
index 0f27f85..48a83cd 100644
--- a/src/dfa.c
+++ b/src/dfa.c
@@ -3261,7 +3261,7 @@ dfaexec (struct dfa *d, char const *begin, char *end,

   if (!d->tralloc)
     {
-      realloc_trans_if_necessary (d, 0);
+      realloc_trans_if_necessary (d, 1);
       build_state (0, d);
     }

-- 
2.0.0.rc3

Reply via email to