Fix ancient bug in parsing of BRE-mode regular expressions.
Tom Lane <tgl@sss.pgh.pa.us>
Fix ancient bug in parsing of BRE-mode regular expressions. brenext(), when parsing a '*' quantifier, forgot to return any "value" for the token; per the equivalent case in next(), it should return value 1 to indicate that greedy rather than non-greedy behavior is wanted. The result is that the compiled regexp could behave like 'x*?' rather than the intended 'x*', if we were unlucky enough to have a zero in v->nextvalue at this point. That seems to happen with some reliability if we have '.*' at the beginning of a BRE-mode regexp, although that depends on the initial contents of a stack-allocated struct, so it's not guaranteed to fail. Found by Alexander Lakhin using valgrind testing. This bug seems to be aboriginal in Spencer's code, so back-patch all the way. Discussion: https://postgr.es/m/16814-6c5e3edd2bdf0d50@postgresql.org
Files
| Path | Change | +/− |
|---|---|---|
| src/backend/regex/regc_lex.c | modified | +1 −1 |
| src/test/modules/test_regex/expected/test_regex.out | modified | +8 −0 |
| src/test/modules/test_regex/sql/test_regex.sql | modified | +2 −0 |
Discussion
- BUG #16814: Invalid memory access on regexp_match with .* and BRE 2 messages · 2021-01-07 → 2021-01-08