Fix UB - signed integer overflow in regex. Thanks to Tim Shen for the patch. Reviewed as https://reviews.llvm.org/D39066
llvm-svn: 316172
Cr-Mirrored-From: sso://chromium.googlesource.com/_direct/external/github.com/llvm/llvm-project
Cr-Mirrored-Commit: 52f0885d4323b85cfed79416de9595e7cbb3ce53
diff --git a/include/regex b/include/regex
index bd72012..80f958e 100644
--- a/include/regex
+++ b/include/regex
@@ -4064,6 +4064,8 @@
__first != __last && ( __val = __traits_.value(*__first, 10)) != -1;
++__first)
{
+ if (__c >= std::numeric_limits<int>::max() / 10)
+ __throw_regex_error<regex_constants::error_badbrace>();
__c *= 10;
__c += __val;
}
diff --git a/test/std/re/re.grammar/excessive_brace_count.pass.cpp b/test/std/re/re.grammar/excessive_brace_count.pass.cpp
new file mode 100644
index 0000000..7fe5f04
--- /dev/null
+++ b/test/std/re/re.grammar/excessive_brace_count.pass.cpp
@@ -0,0 +1,40 @@
+//===----------------------------------------------------------------------===//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is dual licensed under the MIT and the University of Illinois Open
+// Source Licenses. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+// <regex>
+// UNSUPPORTED: libcpp-no-exceptions
+// UNSUPPORTED: c++03
+
+// the "n" in `a{n}` should be within the numeric limits.
+
+#include <regex>
+#include <cassert>
+
+int main() {
+ for (std::regex_constants::syntax_option_type op :
+ {std::regex::basic, std::regex::grep}) {
+ try {
+ (void)std::regex("a\\{100000000000000000\\}", op);
+ assert(false);
+ } catch (const std::regex_error &e) {
+ assert(e.code() == std::regex_constants::error_badbrace);
+ }
+ }
+ for (std::regex_constants::syntax_option_type op :
+ {std::regex::ECMAScript, std::regex::extended, std::regex::egrep,
+ std::regex::awk}) {
+ try {
+ (void)std::regex("a{100000000000000000}", op);
+ assert(false);
+ } catch (const std::regex_error &e) {
+ assert(e.code() == std::regex_constants::error_badbrace);
+ }
+ }
+ return 0;
+}