bryancall opened a new pull request, #13684:
URL: https://github.com/apache/trafficserver/pull/13684

   Third of four, split out of #13671 at review request. Independent of the 
other three;
   it touches neither the shared contexts nor the JIT stack.
   
   ### A failed recompile left freed memory in the object
   
   `Regex::compile()` freed the pattern it already held *before* calling 
`pcre2_compile()`.
   Every failure path after that point returned with the freed pointer still 
stored, so
   `empty()` reported the object as compiled, `exec()` passed the freed block to
   `pcre2_match()`, and the destructor freed it a second time.
   
   Compile into a local and replace the member only after the new pattern 
exists. A failed
   compile now leaves the previous pattern in place and usable, which is what a 
caller
   checking the return value would expect, and a fresh object that fails to 
compile is still
   empty. The header says so on both overloads; it did not before.
   
   ### Tests
   
   Two sections. A valid compile followed by a failing one must leave the first 
pattern
   matching, including its capture groups, and the object must still accept a 
later
   successful compile.
   
   Built against the unfixed implementation the first of those segmentation 
faults, which is
   the point: it is a use-after-free reachable from any caller that recompiles, 
and
   `remap.config` reload is one.
   
   ### Verification
   
   Fedora 44, gcc 16.2.1, PCRE2 10.47. `[Regex]` clean under AddressSanitizer 
with UBSan.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to