Tcl Source Code

Check-in [f8f456846f]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:3610026 Stop crash when the number of "colors" in a regular expression overflows a short int. Thanks to Heikki Linnakangas for the report and the patch.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: f8f456846fff2932546f0e88cfa655ac74b822a6
User & Date: dgp 2013-04-08 20:07:07
Context
2013-04-08
20:29
fix http package installation check-in: 106daecfca user: jan.nijtmans tags: trunk
20:07
3610026 Stop crash when the number of "colors" in a regular expression overflows a short int. Thank... check-in: f8f456846f user: dgp tags: trunk
19:59
3610026 Stop crash when the number of "colors" in a regular expression overflows a short int. Thank... check-in: a0f071f00b user: dgp tags: core-8-5-branch
15:58
Documentation fix. check-in: e3d216f079 user: dgp tags: trunk
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Changes to ChangeLog.









1
2
3
4
5
6
7








2013-04-04  Reinhard Max  <[email protected]>

	* library/http/http.tcl (http::geturl): Allow URLs that don't have
	a path, but a query query, e.g. http://example.com?foo=bar .
	* Bump the http package to 2.8.7.

2013-03-22  Venkat Iyer <[email protected]>
>
>
>
>
>
>
>
>







1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
2013-04-08  Don Porter  <[email protected]>

	* generic/regc_color.c:	[Bug 3610026] Stop crash when the number of
	* generic/regerrs.h:	"colors" in a regular expression overflows
	* generic/regex.h:	a short int.  Thanks to Heikki Linnakangas
	* generic/regguts.h:	for the report and the patch.
	* tests/regexp.test:

2013-04-04  Reinhard Max  <[email protected]>

	* library/http/http.tcl (http::geturl): Allow URLs that don't have
	a path, but a query query, e.g. http://example.com?foo=bar .
	* Bump the http package to 2.8.7.

2013-03-22  Venkat Iyer <[email protected]>

Changes to generic/regc_color.c.

250
251
252
253
254
255
256




257



258
259
260
261
262
263
264
    } else {
	struct colordesc *newCd;

	/*
	 * Oops, must allocate more.
	 */





	n = cm->ncds * 2;



	if (cm->cd == cm->cdspace) {
	    newCd = (struct colordesc *) MALLOC(n * sizeof(struct colordesc));
	    if (newCd != NULL) {
		memcpy(newCd, cm->cdspace,
			cm->ncds * sizeof(struct colordesc));
	    }
	} else {







>
>
>
>

>
>
>







250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
    } else {
	struct colordesc *newCd;

	/*
	 * Oops, must allocate more.
	 */

	if (cm->max == MAX_COLOR) {
	    CERR(REG_ECOLORS);
	    return COLORLESS;		/* too many colors */
	}
	n = cm->ncds * 2;
	if (n < MAX_COLOR + 1) {
	    n = MAX_COLOR + 1;
	}
	if (cm->cd == cm->cdspace) {
	    newCd = (struct colordesc *) MALLOC(n * sizeof(struct colordesc));
	    if (newCd != NULL) {
		memcpy(newCd, cm->cdspace,
			cm->ncds * sizeof(struct colordesc));
	    }
	} else {

Changes to generic/regerrs.h.

13
14
15
16
17
18
19

{ REG_ESPACE,	"REG_ESPACE",	"out of memory" },
{ REG_BADRPT,	"REG_BADRPT",	"quantifier operand invalid" },
{ REG_ASSERT,	"REG_ASSERT",	"\"can't happen\" -- you found a bug" },
{ REG_INVARG,	"REG_INVARG",	"invalid argument to regex function" },
{ REG_MIXED,	"REG_MIXED",	"character widths of regex and string differ" },
{ REG_BADOPT,	"REG_BADOPT",	"invalid embedded option" },
{ REG_ETOOBIG,	"REG_ETOOBIG",	"nfa has too many states" },








>
13
14
15
16
17
18
19
20
{ REG_ESPACE,	"REG_ESPACE",	"out of memory" },
{ REG_BADRPT,	"REG_BADRPT",	"quantifier operand invalid" },
{ REG_ASSERT,	"REG_ASSERT",	"\"can't happen\" -- you found a bug" },
{ REG_INVARG,	"REG_INVARG",	"invalid argument to regex function" },
{ REG_MIXED,	"REG_MIXED",	"character widths of regex and string differ" },
{ REG_BADOPT,	"REG_BADOPT",	"invalid embedded option" },
{ REG_ETOOBIG,	"REG_ETOOBIG",	"nfa has too many states" },
{ REG_ECOLORS,	"REG_ECOLORS",	"too many colors" },

Changes to generic/regex.h.

277
278
279
280
281
282
283

284
285
286
287
288
289
290
#define	REG_ESPACE	12	/* out of memory */
#define	REG_BADRPT	13	/* quantifier operand invalid */
#define	REG_ASSERT	15	/* "can't happen" -- you found a bug */
#define	REG_INVARG	16	/* invalid argument to regex function */
#define	REG_MIXED	17	/* character widths of regex and string differ */
#define	REG_BADOPT	18	/* invalid embedded option */
#define	REG_ETOOBIG	19	/* nfa has too many states */

/* two specials for debugging and testing */
#define	REG_ATOI	101	/* convert error-code name to number */
#define	REG_ITOA	102	/* convert error-code number to name */

/*
 * the prototypes, as possibly munched by regfwd
 */







>







277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
#define	REG_ESPACE	12	/* out of memory */
#define	REG_BADRPT	13	/* quantifier operand invalid */
#define	REG_ASSERT	15	/* "can't happen" -- you found a bug */
#define	REG_INVARG	16	/* invalid argument to regex function */
#define	REG_MIXED	17	/* character widths of regex and string differ */
#define	REG_BADOPT	18	/* invalid embedded option */
#define	REG_ETOOBIG	19	/* nfa has too many states */
#define	REG_ECOLORS	20	/* too many colors */
/* two specials for debugging and testing */
#define	REG_ATOI	101	/* convert error-code name to number */
#define	REG_ITOA	102	/* convert error-code number to name */

/*
 * the prototypes, as possibly munched by regfwd
 */

Changes to generic/regguts.h.

141
142
143
144
145
146
147

148
149
150
151
152
153
154
/*
 * As soon as possible, we map chrs into equivalence classes -- "colors" --
 * which are of much more manageable number.
 */

typedef short color;		/* colors of characters */
typedef int pcolor;		/* what color promotes to */

#define	COLORLESS	(-1)	/* impossible color */
#define	WHITE		0	/* default color, parent of all others */

/*
 * A colormap is a tree -- more precisely, a DAG -- indexed at each level by a
 * byt of the chr, to map the chr to a color efficiently. Because lower
 * sections of the tree can be shared, it can exploit the usual sparseness of







>







141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
/*
 * As soon as possible, we map chrs into equivalence classes -- "colors" --
 * which are of much more manageable number.
 */

typedef short color;		/* colors of characters */
typedef int pcolor;		/* what color promotes to */
#define MAX_COLOR	SHRT_MAX /* max color value */
#define	COLORLESS	(-1)	/* impossible color */
#define	WHITE		0	/* default color, parent of all others */

/*
 * A colormap is a tree -- more precisely, a DAG -- indexed at each level by a
 * byt of the chr, to map the chr to a color efficiently. Because lower
 * sections of the tree can be shared, it can exploit the usual sparseness of

Changes to tests/regexp.test.

861
862
863
864
865
866
867











868
869
870
871
872
873
874
	[a 671]([a 55])[a 669]([a 55])[a 668]([a 55])[a 669]([a 55]) \
	[a 669]([a 55])[a 669]([a 55])[a 668]([a 55])[a 669]([a 55]) \
	[a 668]([a 55])[a 710]([a 55])[a 668]([a 55])[a 668]([a 55]) \
	[a 668]([a 55])[a 668]([a 55])[a 668]([a 55])[a 511]] {}] a
} -cleanup {
    rename a {}
} -returnCodes 1 -result {couldn't compile regular expression pattern: nfa has too many states}












test regexp-23.1 {regexp -all and -line} {
    set string ""
    list \
	[regexp -all -inline -indices -line -- {^} $string] \
	[regexp -all -inline -indices -line -- {^$} $string] \
	[regexp -all -inline -indices -line -- {$} $string]







>
>
>
>
>
>
>
>
>
>
>







861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
	[a 671]([a 55])[a 669]([a 55])[a 668]([a 55])[a 669]([a 55]) \
	[a 669]([a 55])[a 669]([a 55])[a 668]([a 55])[a 669]([a 55]) \
	[a 668]([a 55])[a 710]([a 55])[a 668]([a 55])[a 668]([a 55]) \
	[a 668]([a 55])[a 668]([a 55])[a 668]([a 55])[a 511]] {}] a
} -cleanup {
    rename a {}
} -returnCodes 1 -result {couldn't compile regular expression pattern: nfa has too many states}
test regexp-22.5 {Bug 3610026} -setup {
    set e {}
    set cp 99
    while {$cp < 32864} {
	append e [format %c [incr cp]]
    }
} -body {
    regexp -about $e
} -cleanup {
    unset -nocomplain e cp
} -returnCodes error  -match glob -result {*too many colors*}

test regexp-23.1 {regexp -all and -line} {
    set string ""
    list \
	[regexp -all -inline -indices -line -- {^} $string] \
	[regexp -all -inline -indices -line -- {^$} $string] \
	[regexp -all -inline -indices -line -- {$} $string]