M4 Problem with Macro 'regexp' (2)

[Frank Schwidom]

Dear Developers.

I investigated the yesterday to you reported bug exactlier and i found, 
that the originating problem is to find in libc6 (maybe this is 
glibc-2.3.2 because (a) this link /lib/libc.so.6 -> libc-2.3.2.so and 
(b) the installing of the source of libc6-dev and libc6 causes the 
installing of glibc-2.3.2 in debian). The file test3.m4 in the report 
shows an easier understandable m4-source-sode of the bug. Well. If the 
Bug appears, m4 outputs an 'Error matching regular expression'.

In the m4 is the following code responsible for this behaviour:
builtin.c:
static void
m4_regexp (struct obstack *obs, int argc, token_data **argv)
{
...
 length = strlen (victim);
 startpos = re_search (&buf, victim, length, 0, length, &regs);
 xfree (buf.buffer);

 if (startpos  == -2)
   {
     M4ERROR ((warning_status, 0,
               "Error matching regular expression \"%s\"", regexp));
     return;
   }
...
}

The corresponding Code in glibc-2.3.2 is the following:

posix/regexec.c:
static int
re_search_stub (bufp, string, length, start, range, stop, regs, ret_len)
{
...

 pmatch = re_malloc (regmatch_t, nregs);
 if (BE (pmatch == NULL, 0))
   return -2;

...
}

I cannot really believe, that re_malloc cannot allocate Memory (I have 1 
GB, this sould be enough for this little String). It seems to be 
non-ambiguous, except the following case occurs (later in the code):

static int
re_search_stub (bufp, string, length, start, range, stop, regs, ret_len)
{
...

 pmatch = re_malloc (regmatch_t, nregs);
 if (BE (pmatch == NULL, 0))
   return -2;


 result = re_search_internal (bufp, string, length, start, range, stop,
                              nregs, pmatch, eflags);

 rval = 0;

 /* I hope we needn't fill ther regs with -1's when no match was found.  */
 if (result != REG_NOERROR)
   rval = -1;
 else if (regs != NULL)
   {
     /* If caller wants register contents data back, copy them.  */
     bufp->regs_allocated = re_copy_regs (regs, pmatch, nregs,
                                          bufp->regs_allocated);
     if (BE (bufp->regs_allocated == REGS_UNALLOCATED, 0))
       rval = -2; //              <= here       <= here        <= here
   }

 if (BE (rval == 0, 1))
   {
     if (ret_len) // <= here not: ret_len is 0 because re_search calls 
re_search_stub with parameter ret_len set to 0 (m4 calls re_search)
       {
         assert (pmatch[0].rm_so == start); <= here not
         rval = pmatch[0].rm_eo - start;
       }
     else
       rval = pmatch[0].rm_so; // <= or here?
   }

...
}

This is only read by me and not tested in any way, because i better keep 
the present libc6 working on my computer. But, I hope, I could help 
something.

Regards, Frank Schwidom.

report.tgz
Description: GNU Unix tar archive