From 8a0258c31808c514755e3bba03cb052084c4887c Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Wed, 12 Aug 2015 00:48:11 -0400 Subject: [PATCH] Fix some possible low-memory failures in regexp compilation. newnfa() failed to set the regex error state when malloc() fails. Several places in regcomp.c failed to check for an error after calling subre(). Each of these mistakes could lead to null-pointer-dereference crashes in memory-starved backends. Report and patch by Andreas Seltenreich. Back-patch to all branches. --- src/backend/regex/regc_nfa.c | 3 +++ src/backend/regex/regcomp.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/src/backend/regex/regc_nfa.c b/src/backend/regex/regc_nfa.c index 3487734a64..27998d688a 100644 --- a/src/backend/regex/regc_nfa.c +++ b/src/backend/regex/regc_nfa.c @@ -52,7 +52,10 @@ newnfa(struct vars * v, nfa = (struct nfa *) MALLOC(sizeof(struct nfa)); if (nfa == NULL) + { + ERR(REG_ESPACE); return NULL; + } nfa->states = NULL; nfa->slast = NULL; diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c index ef1d35b0aa..72b0d76af6 100644 --- a/src/backend/regex/regcomp.c +++ b/src/backend/regex/regcomp.c @@ -942,6 +942,7 @@ parseqatom(struct vars * v, NOERR(); assert(v->nextvalue > 0); atom = subre(v, 'b', BACKR, lp, rp); + NOERR(); subno = v->nextvalue; atom->subno = subno; EMPTYARC(lp, rp); /* temporarily, so there's something */ @@ -1076,6 +1077,7 @@ parseqatom(struct vars * v, /* break remaining subRE into x{...} and what follows */ t = subre(v, '.', COMBINE(qprefer, atom->flags), lp, rp); + NOERR(); t->left = atom; atomp = &t->left; @@ -1084,6 +1086,7 @@ parseqatom(struct vars * v, /* split top into prefix and remaining */ assert(top->op == '=' && top->left == NULL && top->right == NULL); top->left = subre(v, '=', top->flags, top->begin, lp); + NOERR(); top->op = '.'; top->right = t; -- 2.40.0