1 Mar 2009 01:04
Bug#517625: libc6-dev: compile() in obsolete <regexp.h> returns incorrect values wrt SUSv2
Kalle Olavi Niemitalo <kon <at> iki.fi>
2009-03-01 00:04:35 GMT
2009-03-01 00:04:35 GMT
Package: libc6-dev
Version: 2.7-16
Severity: normal
File: /usr/include/regexp.h
According to SUSv2, compile() defined in <regexp.h> must invoke
RETURN(ptr) if it succeeds or ERROR(val) if it fails. The
current implementation in glibc violates the standard in two
ways:
(1) It often invokes RETURN in error situations. For example, it
maps REG_EBRACE to RETURN(44). That should be ERROR(44)
instead.
(2) If it succeeds, it invokes RETURN with a pointer that points
outside the buffer provided by the caller. It should have
placed the compiled regexp object at the beginning of the
buffer and given to RETURN a pointer just beyond the end of
the object. SUSv2 says the pointer is useful for memory
allocation; presumably, an application could use the
remaining part of the buffer for other purposes. The
application cannot do that when the pointer points somewhere
else entirely. It seems compile() actually sets up
__expr_ptr->buffer and __expr_ptr->allocated in order to tell
regcomp() where it should place the compiled data, but
regcomp() then clears those members right away and allocates
its own buffer.
With bugs like this, it may be better to remove <regexp.h> than
fix it.
(Continue reading)
RSS Feed