bug in regex when compiled with -DMBS_SUPPORT

[Daryl Habersetzer - ProdEng DRAM]

I (believe) I have found a bug in regexec ONLY when it is compiled with 
MBS_SUPPORT.

When the string you are searching exceeds 931667 bytes, regexec will seg fault. 
 I've
attached two files to illustrate:

make_test_file -> a short perl script to create a test file
bug.c -> a c program to illustrate the problem

%gcc -o bug bug.c
%perl make_test_file 981668 > test_file
%bug test_file

some specifics:
I am using:
glibc-2.2.2
gcc-2.96
Mandrake 8.0 distribution:
Linux pelinux3.micron.com 2.4.7-12.3mdk #1 Mon Aug 20 16:16:58 MDT 2001 i686 
unknown

Please let me know if you need any more information.

Regards,

Daryl Habersetzer

#!/usr/local/bin/perl
my $bytes = shift @ARGV;

my $filler = "abcdefghijklmnopqrstuvwxyz\n";

my $times = $bytes/length($filler);
print $filler x $times;
print "FIND ME\n";

#include <stdio.h>
#include <regex.h> 
#include <sys/stat.h>

int main(int argc, char **argv)
{
    char *input;
    char *str_ptr;
    regmatch_t pmatch;
    regex_t expbuf;
    struct stat statbuf;
    FILE *ifp;

    input = (char *) strdup(argv[1]);

    if (stat(input, &statbuf) == 0) {
            if ((ifp = fopen(input,"rb")) == NULL) {
                printf("Can't open %s for input\n",input);
                exit(1);
            }
            /* read the entire input file into one big string */
            str_ptr = (char *) malloc((int)statbuf.st_size +1);
            if (str_ptr == NULL || fread(str_ptr,(int)statbuf.st_size,1,ifp) != 
1) {
                printf("Error reading file %s\n",input);
                fclose(ifp);
                if (str_ptr)
                    free(str_ptr);
                exit(1);
            }
            fclose(ifp);
            *(str_ptr + statbuf.st_size) = '\0';
    }
    printf("Read %d bytes from %s into str_ptr.\n",statbuf.st_size,input);

    if (regcomp(&expbuf,"FIND ME",REG_NEWLINE) != 0)
            exit(1);

    printf("Compiled re.\n");

    if (regexec(&expbuf,str_ptr,(size_t) 1,&pmatch,0) == 0)
        printf("Found it.\n");
    else 
        printf("Didn't find it.\n");

    regfree(&expbuf);
}