re_intuit_start()/S_reghop3(): don't go beyond end

RT #132552

when hopping N characters along a string, if the 'end stop' lim wasn't
on a char boundary, the value returned by S_reghop3() could be up to
(but not including) one char's worth of bytes beyond lim.

This is fairly harmless, but gave valgrind/ASan palpitations.

So fixed by this commit.

diff --git a/regexec.c b/regexec.c
index 0659724..cd424fd 100644 (file)
--- a/regexec.c
+++ b/regexec.c
@@ -9486,7 +9486,10 @@ S_reghop3(U8 *s, SSize_t off, const U8* lim)
     if (off >= 0) {
        while (off-- && s < lim) {
            /* XXX could check well-formedness here */
-           s += UTF8SKIP(s);
+           U8 *new_s = s + UTF8SKIP(s);
+            if (new_s > lim) /* lim may be in the middle of a long character */
+                return s;
+            s = new_s;
        }
     }
     else {

diff --git a/t/re/re_tests b/t/re/re_tests
index 9dff78c..62ea307 100644 (file)
--- a/t/re/re_tests
+++ b/t/re/re_tests
@@ -1985,6 +1985,7 @@ AB\s+\x{100}      AB \x{100}X     y       -       -
 /(?xx)[a b]/x  \N{SPACE}       n       -       -
 /(?-x:[a b])/xx        \N{SPACE}       yS      $&              # Note a space char here
 ^a?bcd\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff     ABCDEFGHIJKLMNOPQRSTUVWXYZ      n       -       -       # [perl #132187] for valgrind's benefit
+^Xaaa?Xaa      aaa\x{400000}   n       -       -       # [perl #132552] for valgrind's benefit
 
 # Keep these lines at the end of the file
 # vim: softtabstop=0 noexpandtab