diff mbox

Fix another memory leak in regexp compiler (BZ #17069)

Message ID 87y4wrn9o9.fsf@igel.home
State Committed
Headers

Commit Message

Andreas Schwab June 20, 2014, 10:43 a.m. UTC 
  [BZ #17069]
        * posix/regcomp.c (parse_reg_exp): Deallocate partially
	constructed tree before returning error.
	* posix/bug-regexp36.c: Expand test case.

Comments

Ondrej Bilka June 20, 2014, 10:55 a.m. UTC | #1 
On Fri, Jun 20, 2014 at 12:43:18PM +0200, Andreas Schwab wrote:
> 	[BZ #17069]
>         * posix/regcomp.c (parse_reg_exp): Deallocate partially
> 	constructed tree before returning error.
> 	* posix/bug-regexp36.c: Expand test case.
> 
Looks ok.
diff mbox

Patch

diff --git a/posix/bug-regex36.c b/posix/bug-regex36.c
index 3dda026..59e2b6d 100644
--- a/posix/bug-regex36.c
+++ b/posix/bug-regex36.c
@@ -1,4 +1,4 @@ 
-/* Test regcomp not leaking memory on invalid repetition operator
+/* Test regcomp not leaking memory on parse errors
    Copyright (C) 2014 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
@@ -24,6 +24,6 @@  main (int argc, char **argv)
 {
   regex_t r;
   mtrace ();
-  regcomp (&r, "[a]\\{-2,}", 0);
+  regcomp (&r, "[a]\\|[a]\\{-2,}", 0);
   regfree (&r);
 }
diff --git a/posix/regcomp.c b/posix/regcomp.c
index a5020be..076eca3 100644
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -2154,7 +2154,11 @@  parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token,
 	{
 	  branch = parse_branch (regexp, preg, token, syntax, nest, err);
 	  if (BE (*err != REG_NOERROR && branch == NULL, 0))
-	    return NULL;
+	    {
+	      if (tree != NULL)
+		postorder (tree, free_tree, NULL);
+	      return NULL;
+	    }
 	}
       else
 	branch = NULL;