Fix low-probability memory leak in regex execution.

After an internal failure in shortest() or longest() while pinning down the
exact location of a match, find() forgot to free the DFA structure before
returning.  This is pretty unlikely to occur, since we just successfully
ran the "search" variant of the DFA; but it could happen, and it would
result in a session-lifespan memory leak since this code uses malloc()
directly.  Problem seems to have been aboriginal in Spencer's library,
so back-patch all the way.

In passing, correct a thinko in a comment I added awhile back about the
meaning of the "ntree" field.

I happened across these issues while comparing our code to Tcl's version
of the library.

diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c
index fe352acc5f8e87e6323d0b14d83c07846e369449..3e2440ccc336e7d8c4b48bd20caa1f584155396f 100644 (file)
--- a/src/backend/regex/regcomp.c
+++ b/src/backend/regex/regcomp.c
@@ -228,7 +228,7 @@ struct vars
        struct subre *tree;                     /* subexpression tree */
        struct subre *treechain;        /* all tree nodes allocated */
        struct subre *treefree;         /* any free tree nodes */
-       int                     ntree;                  /* number of tree nodes */
+       int                     ntree;                  /* number of tree nodes, plus one */
        struct cvec *cv;                        /* interface cvec */
        struct cvec *cv2;                       /* utility cvec */
        struct subre *lacons;           /* lookahead-constraint vector */

diff --git a/src/backend/regex/regexec.c b/src/backend/regex/regexec.c
index 5e78f8149c8783291b489a8db980d417e314f46d..b4a3dc3ab4038949eea242892c6dcf02a0aa9624 100644 (file)
--- a/src/backend/regex/regexec.c
+++ b/src/backend/regex/regexec.c
@@ -348,7 +348,11 @@ find(struct vars * v,
                                                   (chr **) NULL, &hitend);
                else
                        end = longest(v, d, begin, v->stop, &hitend);
-               NOERR();
+               if (ISERR())
+               {
+                       freedfa(d);
+                       return v->err;
+               }
                if (hitend && cold == NULL)
                        cold = begin;
                if (end != NULL)

diff --git a/src/include/regex/regguts.h b/src/include/regex/regguts.h
index b173c98e4eac76a3f4079a60e800098bf9d5b7b3..db3a89d785a64e99d4fdddd25c0996c24014f9bf 100644 (file)
--- a/src/include/regex/regguts.h
+++ b/src/include/regex/regguts.h
@@ -465,7 +465,7 @@ struct guts
        size_t          nsub;                   /* copy of re_nsub */
        struct subre *tree;
        struct cnfa search;                     /* for fast preliminary search */
-       int                     ntree;                  /* number of subre's, less one */
+       int                     ntree;                  /* number of subre's, plus one */
        struct colormap cmap;
        int                     FUNCPTR(compare, (const chr *, const chr *, size_t));
        struct subre *lacons;           /* lookahead-constraint vector */