From: Paul Eggert <eggert@cs.ucla.edu>
Date: Fri, 22 Jan 2010 20:03:56 +0000 (-0800)
Subject: prune_impossible_nodes: Avoid overflow in computing re_malloc buffer size
X-Git-Tag: glibc-2.12~224
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=4cd028677b55c8be454bb06f0b28a8b41beffe9b;p=platform%2Fupstream%2Fglibc.git

prune_impossible_nodes: Avoid overflow in computing re_malloc buffer size
---

diff --git a/ChangeLog b/ChangeLog
index 9b3fe33..1975f6d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2010-01-22  Jim Meyering  <jim@meyering.net>
 
+	[BZ #11189]
+	* posix/regexec.c (prune_impossible_nodes): Avoid overflow
+	in computing re_malloc buffer size.
+
 	[BZ #11188]
 	* posix/regexec.c (build_trtable): Avoid arithmetic overflow
 	in size calculation.
diff --git a/posix/regexec.c b/posix/regexec.c
index 3765d00..a3a7a60 100644
--- a/posix/regexec.c
+++ b/posix/regexec.c
@@ -949,6 +949,11 @@ prune_impossible_nodes (mctx)
 #endif
   match_last = mctx->match_last;
   halt_node = mctx->last_node;
+
+  /* Avoid overflow.  */
+  if (BE (SIZE_MAX / sizeof (re_dfastate_t *) <= match_last, 0))
+    return REG_ESPACE;
+
   sifted_states = re_malloc (re_dfastate_t *, match_last + 1);
   if (BE (sifted_states == NULL, 0))
     {