Subject: bug#25390: Segfault with sed 4.3

From: Norihiro Tanaka <[email-masked]>
Date: Mon, 09 Jan 2017 23:04:05 +0900

On Sun, 8 Jan 2017 22:12:02 -0800
Paul Eggert <[email-masked]> wrote:

> Norihiro Tanaka wrote:
> > I wrote two additional patches for dfa.  First, derive number of
> > allocation from not argument but number of state in transition table
> > allocation.  Second, melt down dfastate() into build_state().  Now, I
> > think that there do not have to be separated.
> 
> Thanks, I installed those two patches into Gnulib.

Thanks.

> > I also wrote a simple test, but the issue are not always caused, as it
> > depends on state of memory.  Should we rely to complate the test on
> > valgrind?
> 
> Yes, I expect the 'sed' folks would prefer the test to use valgrind. You can look at testsuite/invalid-mb-seq-UMR.sh for an example of a test that does that.

Thanks, I updated the test.  The new test uses valgrind.
From 62541fd0c39ede4b3796417b34edc9da93321582 Mon Sep 17 00:00:00 2001
From: Norihiro Tanaka <[email-masked]>
Date: Mon, 9 Jan 2017 08:54:28 +0900
Subject: [PATCH] tests: new test for dfa crash bug

Maybe dfa crashes if multi-lines are read in pattern space.  It is fixed
at commit 823b5cb589366f7c8742503af980803afad0978f in gnulib.
Reported by S. Gilles in https://bugs.gnu.org/25390

* testsuite/newline.sh: New test.
* testsuite/Makefile.tests: Add the test.
* testsuite/local.mk: Add the test.
---
 testsuite/local.mk   |    1 +
 testsuite/newline.sh |   37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 0 deletions(-)
 create mode 100755 testsuite/newline.sh

diff --git a/testsuite/local.mk b/testsuite/local.mk
index fae6225..325e18b 100644
--- a/testsuite/local.mk
+++ b/testsuite/local.mk
@@ -38,6 +38,7 @@ T =					\
   testsuite/mb-charclass-non-utf8.sh	\
   testsuite/mb-match-slash.sh		\
   testsuite/mb-y-translate.sh		\
+  testsuite/newline.sh			\
   testsuite/normalize-text.sh		\
   testsuite/nulldata.sh			\
   testsuite/panic-tests.sh		\
diff --git a/testsuite/newline.sh b/testsuite/newline.sh
new file mode 100755
index 0000000..14d9150
--- /dev/null
+++ b/testsuite/newline.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+# sed may access to uninitialized memory if transit to 15th dfa state
+# with newline.  This bug affected sed version 4.3.
+
+# Copyright (C) 2017 Free Software Foundation, Inc.
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+. "${srcdir=.}/testsuite/init.sh"; path_prepend_ ./sed
+print_ver_ sed
+
+require_valgrind_
+
+printf '0123456789abcd\nx\n' > in || framework_failure_
+printf 'x\n' > exp || framework_failure_
+valgrind --quiet --error-exitcode=1 \
+  sed -n 'N;s/0123456789abcd\n//' in > out 2> err || fail=1
+
+# Work around a bug in CentOS 5.10's valgrind
+# FIXME: remove in 2018 or when CentOS 5 is no longer officially supported
+grep 'valgrind: .*Assertion.*failed' err > /dev/null \
+  && skip_ 'you seem to have a buggy version of valgrind'
+
+compare exp out || fail=1
+compare /dev/null err || fail=1
+
+Exit $fail
-- 
1.7.1