Mercurial > gnulib
diff lib/regcomp.c @ 17710:fe5bf4d5ee95
regex: fix memory leak in compiler
Fix by Andreas Schwab in:
https://sourceware.org/ml/libc-alpha/2014-06/msg00462.html
* lib/regcomp.c (parse_expression): Deallocate partially
constructed tree before returning error.
| author | Paul Eggert <eggert@penguin.cs.ucla.edu> |
|---|---|
| date | Thu, 19 Jun 2014 08:51:30 -0700 |
| parents | 344018b6e5d7 |
| children | 9edabe80a556 |
line wrap: on
line diff
--- a/lib/regcomp.c Thu Jun 19 08:22:20 2014 -0700 +++ b/lib/regcomp.c Thu Jun 19 08:51:30 2014 -0700 @@ -2460,14 +2460,22 @@ while (token->type == OP_DUP_ASTERISK || token->type == OP_DUP_PLUS || token->type == OP_DUP_QUESTION || token->type == OP_OPEN_DUP_NUM) { - tree = parse_dup_op (tree, regexp, dfa, token, syntax, err); - if (BE (*err != REG_NOERROR && tree == NULL, 0)) - return NULL; + bin_tree_t *dup_tree = parse_dup_op (tree, regexp, dfa, token, + syntax, err); + if (BE (*err != REG_NOERROR && dup_tree == NULL, 0)) + { + if (tree != NULL) + postorder (tree, free_tree, NULL); + return NULL; + } + tree = dup_tree; /* In BRE consecutive duplications are not allowed. */ if ((syntax & RE_CONTEXT_INVALID_DUP) && (token->type == OP_DUP_ASTERISK || token->type == OP_OPEN_DUP_NUM)) { + if (tree != NULL) + postorder (tree, free_tree, NULL); *err = REG_BADRPT; return NULL; }