Subject: bug#28417: closed (Re: bug#28417: ptx does not terminate when matching a zero length sentence regex)

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 14 Sep 2017 06:39:02 +0000

Your bug report

#28417: ptx does not terminate when matching a zero length sentence regex

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
28417: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=28417
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#28417: ptx does not terminate when matching a zero length sentence regex
From: Bernhard Voelker <[email-masked]>
To: Pádraig Brady <[email-masked]>,Julian Büning <[email-masked]>, [email-masked]
Cc: Oscar Soria Dustmann <[email-masked]>, Daniel Schemmel <[email-masked]>
Date: Thu, 14 Sep 2017 08:38:49 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

On 09/14/2017 02:16 AM, Pádraig Brady wrote:
> +1

thanks for the review, pushed.

Have a nice day,
Berny

Subject: ptx does not terminate when matching a zero length sentence regex
From: Julian Büning <[email-masked]>
To: <[email-masked]>
Cc: Oscar Soria Dustmann <[email-masked]>, Daniel Schemmel <[email-masked]>
Date: Mon, 11 Sep 2017 17:04:43 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

observed behavior:

$ echo | ptx -S $ &
[1] 1000
$ jobs
[1]+  Running                 echo | ptx -S $ &

expected behavior:

$ echo | ptx -S $ &
[1] 1000
[1]+  Done                    echo | ptx -S $

ptx does not terminate in case the specified sentence regex can be
matched but has a match of length zero on input that is non-empty.

The following test cases show the same behavior:
$ echo | ptx -S ^
$ echo | ptx -S "a*"
$ echo | ptx -S "\(\)"
$ echo test | ptx -S "\n*"
$ echo foo > non_empty; ptx non_empty -S $
...

In ptx.c, find_occurs_in_text() calls re_search() and uses the length of
a match (which is falsely assumed to be greater than zero) to advance a
cursor through the input. For a match length of zero, the cursor is
never advanced.

When switching on the results of re_search(), a case 0 could be added.
One possible fix would be to then abort with an error message.

We found this behavior in version 8.27 and can reproduce it in version
8.25 as well as version 8.28.

This behavior was found using Symbolic Execution techniques developed in
the course of the SYMBIOSYS research project at COMSYS, RWTH Aachen
University. This research is supported by the European Research Council
(ERC) under the EU's Horizon 2020 Research and Innovation Programme
grant agreement n. 647295 (SYMBIOSYS).

Best regards,
Julian