Subject: bug#17632: closed (Re: bug#17632: [PATCH] dfa: fix off-by-one under-allocation from recent change)

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 29 May 2014 18:12:02 +0000

Your bug report

#17632: [PATCH] dfa: fix off-by-one under-allocation from recent change

which was filed against the grep package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
17632: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17632
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#17632: [PATCH] dfa: fix off-by-one under-allocation from recent change
From: Jim Meyering <[email-masked]>
To: Paul Eggert <[email-masked]>
Cc: [email-masked], Norihiro Tanaka <[email-masked]>
Date: Thu, 29 May 2014 11:11:11 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

On Thu, May 29, 2014 at 9:56 AM, Paul Eggert <[email-masked]> wrote:
> On 05/29/2014 09:48 AM, Jim Meyering wrote:
>>
>> There was another bug, that made nearly all tests fail when
>> run under valgrind or with ASAN-enabled binaries.

Pushed.  I'll make a pre-release snapshot this evening.

Subject: [PATCH] dfa: fix off-by-one under-allocation from recent change
From: Jim Meyering <[email-masked]>
To: [email-masked], Norihiro Tanaka <[email-masked]>
Date: Thu, 29 May 2014 09:48:07 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

There was another bug, that made nearly all tests fail when
run under valgrind or with ASAN-enabled binaries.
Here's the patch:
From fd5c93d580ffe8d27cadeb829600db974464437f Mon Sep 17 00:00:00 2001
From: Jim Meyering <[email-masked]>
Date: Thu, 29 May 2014 09:44:41 -0700
Subject: [PATCH] dfa: fix off-by-one under-allocation from recent change

Commit v2.19-10-gc32ff67 mistakenly made this change:
  -realloc_trans_if_necessary (d, 1);
  +realloc_trans_if_necessary (d, 0);
which led to a heap buffer overflow.
* src/dfa.c (dfaexec): Allocate space for one state, as before.
---
 src/dfa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/dfa.c b/src/dfa.c
index 0f27f85..48a83cd 100644
--- a/src/dfa.c
+++ b/src/dfa.c
@@ -3261,7 +3261,7 @@ dfaexec (struct dfa *d, char const *begin, char *end,

   if (!d->tralloc)
     {
-      realloc_trans_if_necessary (d, 0);
+      realloc_trans_if_necessary (d, 1);
       build_state (0, d);
     }

-- 
2.0.0.rc3