Fix some possible low-memory failures in regexp compilation.

newnfa() failed to set the regex error state when malloc() fails.
Several places in regcomp.c failed to check for an error after calling
subre().  Each of these mistakes could lead to null-pointer-dereference
crashes in memory-starved backends.

Report and patch by Andreas Seltenreich.  Back-patch to all branches.

diff --git a/src/backend/regex/regc_nfa.c b/src/backend/regex/regc_nfa.c
index 3487734a64ea9fcf4aebda1e18bad568cc4af443..27998d688a8f2a48c0e27dcab7da5dd4378861c6 100644 (file)
--- a/src/backend/regex/regc_nfa.c
+++ b/src/backend/regex/regc_nfa.c
@@ -52,7 +52,10 @@ newnfa(struct vars * v,
 
        nfa = (struct nfa *) MALLOC(sizeof(struct nfa));
        if (nfa == NULL)
+       {
+               ERR(REG_ESPACE);
                return NULL;
+       }
 
        nfa->states = NULL;
        nfa->slast = NULL;

diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c
index ef1d35b0aa9a84eacc4ca0537b329f93dfdf1567..72b0d76af689b6841ae5a4a611f0f400a134e765 100644 (file)
--- a/src/backend/regex/regcomp.c
+++ b/src/backend/regex/regcomp.c
@@ -942,6 +942,7 @@ parseqatom(struct vars * v,
                        NOERR();
                        assert(v->nextvalue > 0);
                        atom = subre(v, 'b', BACKR, lp, rp);
+                       NOERR();
                        subno = v->nextvalue;
                        atom->subno = subno;
                        EMPTYARC(lp, rp);       /* temporarily, so there's something */
@@ -1076,6 +1077,7 @@ parseqatom(struct vars * v,
 
        /* break remaining subRE into x{...} and what follows */
        t = subre(v, '.', COMBINE(qprefer, atom->flags), lp, rp);
+       NOERR();
        t->left = atom;
        atomp = &t->left;
 
@@ -1084,6 +1086,7 @@ parseqatom(struct vars * v,
        /* split top into prefix and remaining */
        assert(top->op == '=' && top->left == NULL && top->right == NULL);
        top->left = subre(v, '=', top->flags, top->begin, lp);
+       NOERR();
        top->op = '.';
        top->right = t;