grep 2.5.1 segfaults

[Tobias C. Rittweiler]

Hi all,

as I'm more inclined to the assumption that, what I encountered while
playing a bit with grep, is actually a bug in the regexp code of glibc,
I CCd to bug-glibc.

System spec etc at first: I'm using grep 2.5.1 which is linked against
glibc 2.3.2 on a 2.4.21 linux system.

Briefly, grepping for the regexp ';\{0\}*' on any file results in a core
dump. Even so this regexp may not be very reasonable (in fact I just
stumbled over it by accident), a sefault shouldn't be the consequence.

The following is the output of `bt' in gdb when running it on the core
file created by a

        grep -e 'typeof.*;\{0\}*' /tmp/test # grep compiled with -g

whereby /tmp/test contains the following lines

        1. typeof();
        2. typeof()
        blah

,-snip--
| Starting program: /tmp/grep-2.5.1/src/grep -e 'typeof.*;\{0\}*' /tmp/test
|
| Program received signal SIGSEGV, Segmentation fault.
| 0x400c5924 in re_comp () from /lib/libc.so.6
| (gdb) bt
| #0  0x400c5924 in re_comp () from /lib/libc.so.6
| #1  0x400c579e in re_comp () from /lib/libc.so.6
| #2  0x400c5776 in re_comp () from /lib/libc.so.6
| #3  0x400c578a in re_comp () from /lib/libc.so.6
| #4  0x400c56f4 in re_comp () from /lib/libc.so.6
| #5  0x400c51a8 in re_comp () from /lib/libc.so.6
| #6  0x400c4790 in re_compile_pattern () from /lib/libc.so.6
| #7  0x0805689b in Gcompile (pattern=0x805cd98 "typeof.*;\\{0\\}*\n", size=15)
| at search.c:213
| #8  0x0804c40b in main (argc=4, argv=0xbffffb14) at grep.c:1700
| #9  0x4002c7d5 in __libc_start_main () from /lib/libc.so.6
`-snap--{/tmp/bt_output}

Unfortunately, I haven't got any time for digging any deeper into this
problem, so I let it up to you... :-)


-- tcr (address@hidden)  ``Ho chresim'eidos uch ho poll'eidos sophos''