From 0c54796b5c7458449152d3f812eee5b6cb014c93 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Wed, 27 Feb 2013 10:40:20 -0500 Subject: [PATCH] Add missing error check in regexp parser. parseqatom() failed to check for an error return (NULL result) from its recursive call to parsebranch(), and in consequence could crash with a null-pointer dereference after an error return. This bug has been there since day one, but wasn't noticed before, probably because most error cases in parsebranch() didn't actually lead to returning NULL. Add the missing error check, and also tweak parsebranch() to exit in a less indirect fashion after a call to parseqatom() fails. Report by Tomasz Karlik, fix by me. --- src/backend/regex/regcomp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c index 715d9fac4d..17e7ce2ea5 100644 --- a/src/backend/regex/regcomp.c +++ b/src/backend/regex/regcomp.c @@ -704,6 +704,7 @@ parsebranch(struct vars * v, /* NB, recursion in parseqatom() may swallow rest of branch */ parseqatom(v, stopper, type, lp, right, t); + NOERRN(); } if (!seencontent) @@ -1148,6 +1149,7 @@ parseqatom(struct vars * v, EMPTYARC(atom->end, rp); t->right = subre(v, '=', 0, atom->end, rp); } + NOERR(); assert(SEE('|') || SEE(stopper) || SEE(EOS)); t->flags |= COMBINE(t->flags, t->right->flags); top->flags |= COMBINE(top->flags, t->flags); -- 2.50.1