Commit 73dc003b authored by Tom Lane's avatar Tom Lane

Add missing error check in regexp parser.

parseqatom() failed to check for an error return (NULL result) from its
recursive call to parsebranch(), and in consequence could crash with a
null-pointer dereference after an error return.  This bug has been there
since day one, but wasn't noticed before, probably because most error cases
in parsebranch() didn't actually lead to returning NULL.  Add the missing
error check, and also tweak parsebranch() to exit in a less indirect
fashion after a call to parseqatom() fails.

Report by Tomasz Karlik, fix by me.
parent 08f97280
...@@ -712,6 +712,7 @@ parsebranch(struct vars * v, ...@@ -712,6 +712,7 @@ parsebranch(struct vars * v,
/* NB, recursion in parseqatom() may swallow rest of branch */ /* NB, recursion in parseqatom() may swallow rest of branch */
parseqatom(v, stopper, type, lp, right, t); parseqatom(v, stopper, type, lp, right, t);
NOERRN();
} }
if (!seencontent) if (!seencontent)
...@@ -1169,6 +1170,7 @@ parseqatom(struct vars * v, ...@@ -1169,6 +1170,7 @@ parseqatom(struct vars * v,
EMPTYARC(s2, rp); EMPTYARC(s2, rp);
t->right = subre(v, '=', 0, s2, rp); t->right = subre(v, '=', 0, s2, rp);
} }
NOERR();
assert(SEE('|') || SEE(stopper) || SEE(EOS)); assert(SEE('|') || SEE(stopper) || SEE(EOS));
t->flags |= COMBINE(t->flags, t->right->flags); t->flags |= COMBINE(t->flags, t->right->flags);
top->flags |= COMBINE(top->flags, t->flags); top->flags |= COMBINE(top->flags, t->flags);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment