diff options
| -rw-r--r-- | llvm/lib/Support/regcomp.c | 4 | ||||
| -rw-r--r-- | llvm/unittests/Support/RegexTest.cpp | 8 |
2 files changed, 10 insertions, 2 deletions
diff --git a/llvm/lib/Support/regcomp.c b/llvm/lib/Support/regcomp.c index 6bf89c9cf1b..354e359f676 100644 --- a/llvm/lib/Support/regcomp.c +++ b/llvm/lib/Support/regcomp.c @@ -1008,7 +1008,7 @@ p_b_coll_elem(struct parse *p, { char *sp = p->next; struct cname *cp; - int len; + size_t len; while (MORE() && !SEETWO(endc, ']')) NEXT(); @@ -1018,7 +1018,7 @@ p_b_coll_elem(struct parse *p, } len = p->next - sp; for (cp = cnames; cp->name != NULL; cp++) - if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0') + if (strncmp(cp->name, sp, len) == 0 && strlen(cp->name) == len) return(cp->code); /* known name */ if (len == 1) return(*sp); /* single character */ diff --git a/llvm/unittests/Support/RegexTest.cpp b/llvm/unittests/Support/RegexTest.cpp index 5e3ce39f005..7e44a3c0614 100644 --- a/llvm/unittests/Support/RegexTest.cpp +++ b/llvm/unittests/Support/RegexTest.cpp @@ -171,4 +171,12 @@ TEST_F(RegexTest, MatchInvalid) { EXPECT_FALSE(r1.match("X")); } +// https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727 +TEST_F(RegexTest, OssFuzz3727Regression) { + // Wrap in a StringRef so the NUL byte doesn't terminate the string + Regex r(StringRef("[[[=GS\x00[=][", 10)); + std::string Error; + EXPECT_FALSE(r.isValid(Error)); +} + } |
