Fix some possible low-memory failures in regexp compilation.

newnfa() failed to set the regex error state when malloc() fails.
Several places in regcomp.c failed to check for an error after calling
subre().  Each of these mistakes could lead to null-pointer-dereference
crashes in memory-starved backends.

Report and patch by Andreas Seltenreich.  Back-patch to all branches.

diff --git a/src/backend/regex/regc_nfa.c b/src/backend/regex/regc_nfa.c
index 776bb59b867e9fd981164a69713c3d8959a944e9..e0d5af205f673cf96da8c78a392c9b43d0626ac3 100644 (file)
--- a/src/backend/regex/regc_nfa.c
+++ b/src/backend/regex/regc_nfa.c
@@ -52,7 +52,10 @@ newnfa(struct vars * v,
 
        nfa = (struct nfa *) MALLOC(sizeof(struct nfa));
        if (nfa == NULL)
+       {
+               ERR(REG_ESPACE);
                return NULL;
+       }
 
        nfa->states = NULL;
        nfa->slast = NULL;

diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c
index 630e2b8402e1e09ee8851088bb85cf38d27b6502..f1539e726a7a3a592ca588800b3cb2d2f27703f8 100644 (file)
--- a/src/backend/regex/regcomp.c
+++ b/src/backend/regex/regcomp.c
@@ -941,6 +941,7 @@ parseqatom(struct vars * v,
                        NOERR();
                        assert(v->nextvalue > 0);
                        atom = subre(v, 'b', BACKR, lp, rp);
+                       NOERR();
                        subno = v->nextvalue;
                        atom->subno = subno;
                        EMPTYARC(lp, rp);       /* temporarily, so there's something */
@@ -1071,6 +1072,7 @@ parseqatom(struct vars * v,
 
        /* break remaining subRE into x{...} and what follows */
        t = subre(v, '.', COMBINE(qprefer, atom->flags), lp, rp);
+       NOERR();
        t->left = atom;
        atomp = &t->left;
 
@@ -1079,6 +1081,7 @@ parseqatom(struct vars * v,
        /* split top into prefix and remaining */
        assert(top->op == '=' && top->left == NULL && top->right == NULL);
        top->left = subre(v, '=', top->flags, top->begin, lp);
+       NOERR();
        top->op = '.';
        top->right = t;