In perl.git, the branch blead has been updated <https://perl5.git.perl.org/perl.git/commitdiff/bfa9f5ee70ce509f0e66dcff9e9fda131ea8a133?hp=e0814905161f8420d3be47dd3883b1f3c9590a82>
- Log ----------------------------------------------------------------- commit bfa9f5ee70ce509f0e66dcff9e9fda131ea8a133 Author: Karl Williamson <[email protected]> Date: Wed Mar 13 21:25:05 2019 -0600 PATCH: [perl #133921] Segfaults in regcomp.c If a regular expression pattern gets too long so that the branch instructions need more bits than are available, it is supposed to reparse and use long jumps instead of the normal ones that don't take up extra room. The blamed commit caused the test for this to be done too late. This just moves the test to do it in time; lexically later in the file, but just after the variable takes on the too-large value and before it gets used in the next loop iteration. commit a9cea67c10bc154f974a3207d7ce3f81611266bc Author: Karl Williamson <[email protected]> Date: Wed Mar 13 21:24:47 2019 -0600 t/re/pat.t: Rmv stray semi-colon ----------------------------------------------------------------------- Summary of changes: regcomp.c | 14 +++++++------- t/re/pat.t | 7 +++++-- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/regcomp.c b/regcomp.c index 51679e9063..15d843e7c2 100644 --- a/regcomp.c +++ b/regcomp.c @@ -12315,16 +12315,16 @@ S_regbranch(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, I32 first, U32 depth) /* FIXME adding one for every branch after the first is probably * excessive now we have TRIE support. (hv) */ MARK_NAUGHTY(1); - if ( chain > (SSize_t) BRANCH_MAX_OFFSET - && ! RExC_use_BRANCHJ) - { - /* XXX We could just redo this branch, but figuring out what - * bookkeeping needs to be reset is a pain */ - REQUIRE_BRANCHJ(flagp, 0); - } REGTAIL(pRExC_state, chain, latest); } chain = latest; + if ( chain > (SSize_t) BRANCH_MAX_OFFSET + && ! RExC_use_BRANCHJ) + { + /* XXX We could just redo this branch, but figuring out what + * bookkeeping needs to be reset is a pain */ + REQUIRE_BRANCHJ(flagp, 0); + } c++; } if (chain == 0) { /* Loop ran zero times. */ diff --git a/t/re/pat.t b/t/re/pat.t index f1be50ae1b..7bb215a1ea 100644 --- a/t/re/pat.t +++ b/t/re/pat.t @@ -24,7 +24,7 @@ BEGIN { skip_all('no re module') unless defined &DynaLoader::boot_DynaLoader; skip_all_without_unicode_tables(); -plan tests => 855; # Update this when adding/deleting tests. +plan tests => 857; # Update this when adding/deleting tests. run_tests() unless caller; @@ -2003,9 +2003,12 @@ while( "\N{U+100}bc" =~ /(..?)(?{$^N})/g ) { CODE } { # [perl #133871], ASAN/valgrind out-of-bounds access -; fresh_perl_like('qr/(?|(())|())|//', qr/syntax error/, {}, "[perl #133871]"); } + { # [perl #133921], segfault + fresh_perl_is('qr0||ß+p00000F00000ù\Q00000ÿ00000x00000x0c0e0\Qx0\Qx0\x{0c!}\;\;î0\x + fresh_perl_is('|ß+W0ü0r0\Qx0\Qx0x0c0G00000000000000000O000000000x0x0x0c!}\;îçÿù\Q0 \x + } } # End of sub run_tests -- Perl5 Master Repository
