From 53673d98756218ddd125311548c0f73c714722f7 Mon Sep 17 00:00:00 2001 From: Jarkko Hietaniemi Date: Mon, 21 Apr 2014 18:15:58 -0400 Subject: [PATCH] Fix for Coverity perl5 CID 29032: Out-of-bounds read (OVERRUN) overrun-local: Overrunning array anyofs of 34 8-byte elements at element index 34 (byte offset 272) using index index (which evaluates to 34). Off-by-one error: because the test "index > number of elements" should have used ">=", the anyofs[] could have been accessed one past the end. Use the C_ARRAY_LENGTH since we have it. I think regprop is only used by -Mre=debug. --- regcomp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/regcomp.c b/regcomp.c index ca2ffb8..0238af9 100644 --- a/regcomp.c +++ b/regcomp.c @@ -15831,10 +15831,7 @@ Perl_regprop(pTHX_ const regexp *prog, SV *sv, const regnode *o, const regmatch_ } else if (k == POSIXD || k == NPOSIXD) { U8 index = FLAGS(o) * 2; - if (index > (sizeof(anyofs) / sizeof(anyofs[0]))) { - Perl_sv_catpvf(aTHX_ sv, "[illegal type=%d])", index); - } - else { + if (index < C_ARRAY_LENGTH(anyofs)) { if (*anyofs[index] != '[') { sv_catpv(sv, "["); } @@ -15843,6 +15840,9 @@ Perl_regprop(pTHX_ const regexp *prog, SV *sv, const regnode *o, const regmatch_ sv_catpv(sv, "]"); } } + else { + Perl_sv_catpvf(aTHX_ sv, "[illegal type=%d])", index); + } } else if (k == BRANCHJ && (OP(o) == UNLESSM || OP(o) == IFMATCH)) Perl_sv_catpvf(aTHX_ sv, "[%d]", -(o->flags)); -- 1.8.3.1