diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2015-08-12 00:48:11 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2015-08-12 00:48:48 -0400 |
| commit | 7a801ba8ce7befc2309ece2ca918eb688c67fda9 (patch) | |
| tree | 69b407637610ebfa8cfb72a81d847dba0c2a1d94 /src/backend/regex/regcomp.c | |
| parent | 34f1a85e513d56980417afe4b47454ffe951bb26 (diff) | |
| download | postgresql-7a801ba8ce7befc2309ece2ca918eb688c67fda9.tar.gz postgresql-7a801ba8ce7befc2309ece2ca918eb688c67fda9.zip | |
Fix some possible low-memory failures in regexp compilation.
newnfa() failed to set the regex error state when malloc() fails.
Several places in regcomp.c failed to check for an error after calling
subre(). Each of these mistakes could lead to null-pointer-dereference
crashes in memory-starved backends.
Report and patch by Andreas Seltenreich. Back-patch to all branches.
Diffstat (limited to 'src/backend/regex/regcomp.c')
| -rw-r--r-- | src/backend/regex/regcomp.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c index 630e2b8402e..f1539e726a7 100644 --- a/src/backend/regex/regcomp.c +++ b/src/backend/regex/regcomp.c @@ -941,6 +941,7 @@ parseqatom(struct vars * v, NOERR(); assert(v->nextvalue > 0); atom = subre(v, 'b', BACKR, lp, rp); + NOERR(); subno = v->nextvalue; atom->subno = subno; EMPTYARC(lp, rp); /* temporarily, so there's something */ @@ -1071,6 +1072,7 @@ parseqatom(struct vars * v, /* break remaining subRE into x{...} and what follows */ t = subre(v, '.', COMBINE(qprefer, atom->flags), lp, rp); + NOERR(); t->left = atom; atomp = &t->left; @@ -1079,6 +1081,7 @@ parseqatom(struct vars * v, /* split top into prefix and remaining */ assert(top->op == '=' && top->left == NULL && top->right == NULL); top->left = subre(v, '=', top->flags, top->begin, lp); + NOERR(); top->op = '.'; top->right = t; |