(parse_dup_op): Fail with REG_BADBR is first number in {,} expression is larger.

diff --git a/posix/regcomp.c b/posix/regcomp.c
index 9a48aa3..0dee2e6 100644 (file)
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -2412,6 +2412,12 @@ parse_dup_op (dup_elem, regexp, dfa, token, syntax, err)
                goto parse_dup_op_espace;
            }
        }
+      else if (BE (start > end, 0))
+       {
+         /* First  number greater than first.  */
+         *err = REG_BADBR;
+         return NULL;
+       }
       else if (end - start > 0)
        {
          /* Then extract "<re>{0,m}" to "<re>?<re>?...<re>?".  */