GNU logs - #32805, boring messages

Message sent to bug-grep@HIDDEN:

Subject: bug#32805: Stack overflow when processing "0?{77}{770}" extended regexp
Resent-From: Anatoly Trosinenko <anatoly.trosinenko@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-grep@HIDDEN
Resent-Date: Sat, 22 Sep 2018 15:21:02 +0000
Resent-Message-ID: <handler.32805.B.153762961818326 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 32805 <at> debbugs.gnu.org
MIME-Version: 1.0
From: Anatoly Trosinenko <anatoly.trosinenko@HIDDEN>
Date: Sat, 22 Sep 2018 17:55:20 +0300
Message-ID: <CAE5jQCfj98tBHegQ5WKpo1wKZ2Mcm8__Fu=AXukCc8sQE6N6Lw@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hello,

When fuzzing GNU grep, I have found a stack overflow on processing a
simple extended regexp. It is reproduced with the latest commit from
master branch 51dacfb (Sep 19).

$ export LC_ALL=C
$ gdb -q --args ./grep -E "0?{77}{770}"
Reading symbols from ./grep...(no debugging symbols found)...done.
(gdb) r
Starting program: /path/to/grep -E 0\?\{77\}\{770\}
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff760230e in _int_malloc (av=av@entry=0x7ffff7959c40
<main_arena>, bytes=bytes@entry=4) at malloc.c:3557
3557    malloc.c: No such file or directory.
(gdb) bt
#0  0x00007ffff760230e in _int_malloc (av=av@entry=0x7ffff7959c40
<main_arena>, bytes=bytes@entry=4) at malloc.c:3557
#1  0x00007ffff76050fc in __GI___libc_malloc (bytes=4) at malloc.c:3057
#2  0x00007ffff766177b in re_node_set_alloc (size=<optimized out>,
set=0x7fffff7ff0d0) at regex_internal.c:963
#3  calc_eclosure_iter (new_set=new_set@entry=0x7fffff7ff170,
dfa=dfa@entry=0x555555788e70, node=116418, root=root@entry=0) at
regcomp.c:1682
#4  0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff200, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#5  0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff290, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#6  0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff320, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#7  0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff3b0, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#8  0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff440, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#9  0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff4d0, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#10 0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff560, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#11 0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff5f0, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#12 0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff680, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#13 0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff710, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
#14 0x00007ffff7661af7 in calc_eclosure_iter
(new_set=new_set@entry=0x7fffff7ff7a0, dfa=dfa@entry=0x555555788e70,
node=<optimized out>, root=root@entry=0) at regcomp.c:1719
... and so on

Best regards
Anatoly

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Anatoly Trosinenko <anatoly.trosinenko@HIDDEN>
Subject: bug#32805: Acknowledgement (Stack overflow when processing
 "0?{77}{770}" extended regexp)
Message-ID: <handler.32805.B.153762961818326.ack <at> debbugs.gnu.org>
References: <CAE5jQCfj98tBHegQ5WKpo1wKZ2Mcm8__Fu=AXukCc8sQE6N6Lw@HIDDEN>
X-Gnu-PR-Message: ack 32805
X-Gnu-PR-Package: grep
Reply-To: 32805 <at> debbugs.gnu.org
Date: Sat, 22 Sep 2018 15:21:03 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-grep@HIDDEN

If you wish to submit further information on this problem, please
send it to 32805 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
32805: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D32805
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Last modified: Mon, 25 Nov 2019 12:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.