[perl #133892] coredump in Perl_re_intuit_start
authorHugo van der Sanden <hv@crypt.org>
Mon, 25 Mar 2019 11:27:12 +0000 (11:27 +0000)
committerHugo van der Sanden <hv@crypt.org>
Wed, 27 Mar 2019 13:11:55 +0000 (13:11 +0000)
Make sure we have a valid non-utf8 'other' check substring before we
try to use it.

regexec.c
t/re/pat_rt_report.t

index 9d67da6..ad589e2 100644 (file)
--- a/regexec.c
+++ b/regexec.c
@@ -1173,8 +1173,8 @@ Perl_re_intuit_start(pTHX_
 
     /* now look for the 'other' substring if defined */
 
-    if (utf8_target ? prog->substrs->data[other_ix].utf8_substr
-                    : prog->substrs->data[other_ix].substr)
+    if (prog->substrs->data[other_ix].utf8_substr
+        || prog->substrs->data[other_ix].substr)
     {
        /* Take into account the "other" substring. */
         char *last, *last1;
@@ -1184,6 +1184,11 @@ Perl_re_intuit_start(pTHX_
 
       do_other_substr:
         other = &prog->substrs->data[other_ix];
+        if (!utf8_target && !other->substr) {
+            if (!to_byte_substr(prog)) {
+                NON_UTF8_TARGET_BUT_UTF8_REQUIRED(fail);
+            }
+        }
 
         /* if "other" is anchored:
          * we've previously found a floating substr starting at check_at.
index de25900..ced4fe6 100644 (file)
@@ -20,7 +20,7 @@ use warnings;
 use 5.010;
 use Config;
 
-plan tests => 2509;  # Update this when adding/deleting tests.
+plan tests => 2510;  # Update this when adding/deleting tests.
 
 run_tests() unless caller;
 
@@ -1147,6 +1147,15 @@ EOP
         ok($s=~/(foo){1,0}|(?1)/,
             "RT #130561 - allowing impossible quantifier should not break recursion");
     }
+       {
+               # RT #133892 Coredump in Perl_re_intuit_start
+               # Second match flips to checking floating substring before fixed
+               # substring, which triggers a pathway that failed to check there
+               # was a non-utf8 version of the string before trying to use it
+               # resulting in a SEGV.
+               my $result = grep /b\x{1c0}ss0/i, qw{ xxxx xxxx0 };
+               ok($result == 0);
+       }
 
 } # End of sub run_tests