GNU bug report logs - #28417
ptx does not terminate when matching a zero length sentence regex

Previous Next

Full log

Message #11 received at 28417 <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: Bernhard Voelker <mail <at> bernhard-voelker.de>,
 Julian Büning <julian.buening <at> rwth-aachen.de>,
 28417 <at> debbugs.gnu.org
Cc: Oscar Soria Dustmann <Oscar.SoriaDustmann <at> comsys.rwth-aachen.de>,
 Daniel Schemmel <daniel.schemmel <at> comsys.rwth-aachen.de>
Subject: Re: bug#28417: ptx does not terminate when matching a zero length
 sentence regex
Date: Wed, 13 Sep 2017 17:16:29 -0700

On 13/09/17 14:40, Bernhard Voelker wrote:
> On 09/11/2017 05:04 PM, Julian Büning wrote:
>> observed behavior:
>>
>> $ echo | ptx -S $ &
>> [1] 1000
>> $ jobs
>> [1]+  Running                 echo | ptx -S $ &
>>
>> expected behavior:
>>
>> $ echo | ptx -S $ &
>> [1] 1000
>> [1]+  Done                    echo | ptx -S $
>>
>> ptx does not terminate in case the specified sentence regex can be
>> matched but has a match of length zero on input that is non-empty.
>>
>> The following test cases show the same behavior:
>> $ echo | ptx -S ^
>> $ echo | ptx -S "a*"
>> $ echo | ptx -S "\(\)"
>> $ echo test | ptx -S "\n*"
>> $ echo foo > non_empty; ptx non_empty -S $
>> ...
>>
>> In ptx.c, find_occurs_in_text() calls re_search() and uses the length of
>> a match (which is falsely assumed to be greater than zero) to advance a
>> cursor through the input. For a match length of zero, the cursor is
>> never advanced.
>>
>> When switching on the results of re_search(), a case 0 could be added.
>> One possible fix would be to then abort with an error message.
>>
>> We found this behavior in version 8.27 and can reproduce it in version
>> 8.25 as well as version 8.28.
>>
>> This behavior was found using Symbolic Execution techniques developed in
>> the course of the SYMBIOSYS research project at COMSYS, RWTH Aachen
>> University. This research is supported by the European Research Council
>> (ERC) under the EU's Horizon 2020 Research and Innovation Programme
>> grant agreement n. 647295 (SYMBIOSYS).
> 
> Good catch!
> The attached patch fixes it; please check.

+1

Thanks to both of you

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.