bryancall opened a new pull request, #13684: URL: https://github.com/apache/trafficserver/pull/13684
Third of four, split out of #13671 at review request. Independent of the other three; it touches neither the shared contexts nor the JIT stack. ### A failed recompile left freed memory in the object `Regex::compile()` freed the pattern it already held *before* calling `pcre2_compile()`. Every failure path after that point returned with the freed pointer still stored, so `empty()` reported the object as compiled, `exec()` passed the freed block to `pcre2_match()`, and the destructor freed it a second time. Compile into a local and replace the member only after the new pattern exists. A failed compile now leaves the previous pattern in place and usable, which is what a caller checking the return value would expect, and a fresh object that fails to compile is still empty. The header says so on both overloads; it did not before. ### Tests Two sections. A valid compile followed by a failing one must leave the first pattern matching, including its capture groups, and the object must still accept a later successful compile. Built against the unfixed implementation the first of those segmentation faults, which is the point: it is a use-after-free reachable from any caller that recompiles, and `remap.config` reload is one. ### Verification Fedora 44, gcc 16.2.1, PCRE2 10.47. `[Regex]` clean under AddressSanitizer with UBSan. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
