Attachment 298831 Details for Bug 435767 – Patch that fixes the bug

[patch] Patch that fixes the bug

emacs-regex-overflow.patch (text/plain), 2.03 KB, created by Alexandre Oliva on 2008-03-22 11:21:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alexandre Oliva

Created: 2008-03-22 11:21:01 UTC

Size: 2.03 KB

patch

obsolete

>for  src/ChangeLog
>from  Alexandre Oliva  <aoliva@redhat.com>
>
>	* regex.c (MOVE_BUFFER_POINTER, EXTEND_BUFFER): Don't compute
>	offsets between unrelated pointers.
>
>--- emacs-22.1.50.orig/src/regex.c	2007-09-10 15:46:20.000000000 -0300
>+++ emacs-22.1.50/src/regex.c	2008-03-22 08:07:06.000000000 -0300
>@@ -3,7 +3,7 @@
>    internationalization features.)
> 
>    Copyright (C) 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
>-                 2002, 2003, 2004, 2005, 2006, 2007
>+                 2002, 2003, 2004, 2005, 2006, 2007, 2008
>                  Free Software Foundation, Inc.
> 
>    This program is free software; you can redistribute it and/or modify
>@@ -1832,8 +1832,10 @@
>    being larger than MAX_BUF_SIZE, then flag memory exhausted.  */
> #if __BOUNDED_POINTERS__
> # define SET_HIGH_BOUND(P) (__ptrhigh (P) = __ptrlow (P) + bufp->allocated)
>-# define MOVE_BUFFER_POINTER(P) \
>-  (__ptrlow (P) += incr, SET_HIGH_BOUND (P), __ptrvalue (P) += incr)
>+# define MOVE_BUFFER_POINTER(P)					\
>+  (__ptrlow (P) = new_buffer + (__ptrlow (P) - old_buffer),	\
>+   SET_HIGH_BOUND (P),						\
>+   __ptrvalue (P) = new_buffer + (__ptrvalue (P) - old_buffer))
> # define ELSE_EXTEND_BUFFER_HIGH_BOUND		\
>   else						\
>     {						\
>@@ -1847,12 +1849,12 @@
> 	SET_HIGH_BOUND (pending_exact);		\
>     }
> #else
>-# define MOVE_BUFFER_POINTER(P) (P) += incr
>+# define MOVE_BUFFER_POINTER(P) ((P) = new_buffer + ((P) - old_buffer))
> # define ELSE_EXTEND_BUFFER_HIGH_BOUND
> #endif
> #define EXTEND_BUFFER()							\
>   do {									\
>-    re_char *old_buffer = bufp->buffer;					\
>+    unsigned char *old_buffer = bufp->buffer;				\
>     if (bufp->allocated == MAX_BUF_SIZE)				\
>       return REG_ESIZE;							\
>     bufp->allocated <<= 1;						\
>@@ -1864,7 +1866,7 @@
>     /* If the buffer moved, move all the pointers into it.  */		\
>     if (old_buffer != bufp->buffer)					\
>       {									\
>-	int incr = bufp->buffer - old_buffer;				\
>+	unsigned char *new_buffer = bufp->buffer;			\
> 	MOVE_BUFFER_POINTER (b);					\
> 	MOVE_BUFFER_POINTER (begalt);					\
> 	if (fixup_alt_jump)						\

Actions: View | Diff

Attachments on bug 435767: 298831