d5245cc
From 9618fb718b75920f37e5be2049ad1d0bb5c4a28c Mon Sep 17 00:00:00 2001
d5245cc
From: Paul Eggert <eggert@cs.ucla.edu>
d5245cc
Date: Tue, 26 Jan 2021 09:23:54 -0800
d5245cc
Subject: [PATCH] expr: fix bug with unmatched \(...\)
d5245cc
d5245cc
Problem reported by Qiuhao Li.
d5245cc
* doc/coreutils.texi (String expressions):
d5245cc
Document the correct behavior, which POSIX requires.
d5245cc
* src/expr.c (docolon): Treat unmatched \(...\) as empty.
d5245cc
* tests/misc/expr.pl: New test.
d5245cc
d5245cc
Upstream-commit: 735083ba24878075235007b4417982ad5700436d
d5245cc
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
d5245cc
---
d5245cc
 doc/coreutils.texi | 14 ++++++++------
d5245cc
 src/expr.c         |  9 +++++++--
d5245cc
 tests/misc/expr.pl |  3 +++
d5245cc
 3 files changed, 18 insertions(+), 8 deletions(-)
d5245cc
d5245cc
diff --git a/doc/coreutils.texi b/doc/coreutils.texi
d5245cc
index 2382a16..5b2bb2c 100644
d5245cc
--- a/doc/coreutils.texi
d5245cc
+++ b/doc/coreutils.texi
d5245cc
@@ -13529,12 +13529,14 @@ second is considered to be a (basic, a la GNU @code{grep}) regular
d5245cc
 expression, with a @code{^} implicitly prepended.  The first argument is
d5245cc
 then matched against this regular expression.
d5245cc
 
d5245cc
-If the match succeeds and @var{regex} uses @samp{\(} and @samp{\)}, the
d5245cc
-@code{:} expression returns the part of @var{string} that matched the
d5245cc
-subexpression; otherwise, it returns the number of characters matched.
d5245cc
-
d5245cc
-If the match fails, the @code{:} operator returns the null string if
d5245cc
-@samp{\(} and @samp{\)} are used in @var{regex}, otherwise 0.
d5245cc
+If @var{regex} does not use @samp{\(} and @samp{\)}, the @code{:}
d5245cc
+expression returns the number of characters matched, or 0 if the match
d5245cc
+fails.
d5245cc
+
d5245cc
+If @var{regex} uses @samp{\(} and @samp{\)}, the @code{:} expression
d5245cc
+returns the part of @var{string} that matched the subexpression, or
d5245cc
+the null string if the match failed or the subexpression did not
d5245cc
+contribute to the match.
d5245cc
 
d5245cc
 @kindex \( @r{regexp operator}
d5245cc
 Only the first @samp{\( @dots{} \)} pair is relevant to the return
d5245cc
diff --git a/src/expr.c b/src/expr.c
d5245cc
index e134872..0616a42 100644
d5245cc
--- a/src/expr.c
d5245cc
+++ b/src/expr.c
d5245cc
@@ -721,8 +721,13 @@ docolon (VALUE *sv, VALUE *pv)
d5245cc
       /* Were \(...\) used? */
d5245cc
       if (re_buffer.re_nsub > 0)
d5245cc
         {
d5245cc
-          sv->u.s[re_regs.end[1]] = '\0';
d5245cc
-          v = str_value (sv->u.s + re_regs.start[1]);
d5245cc
+          if (re_regs.end[1] < 0)
d5245cc
+            v = str_value ("");
d5245cc
+          else
d5245cc
+            {
d5245cc
+              sv->u.s[re_regs.end[1]] = '\0';
d5245cc
+              v = str_value (sv->u.s + re_regs.start[1]);
d5245cc
+            }
d5245cc
         }
d5245cc
       else
d5245cc
         {
d5245cc
diff --git a/tests/misc/expr.pl b/tests/misc/expr.pl
d5245cc
index e45f8e7..e57f79d 100755
d5245cc
--- a/tests/misc/expr.pl
d5245cc
+++ b/tests/misc/expr.pl
d5245cc
@@ -84,6 +84,9 @@ my @Tests =
d5245cc
      # In 5.94 and earlier, anchors incorrectly matched newlines.
d5245cc
      ['anchor', "'a\nb' : 'a\$'", {OUT => '0'}, {EXIT => 1}],
d5245cc
 
d5245cc
+     # In 8.32, \( ... \) that did not match caused memory errors.
d5245cc
+     ['emptysub', '"a" : "\\(b\\)*"', {OUT => ''}, {EXIT => 1}],
d5245cc
+
d5245cc
      # These tests are taken from grep/tests/bre.tests.
d5245cc
      ['bre1', '"abc" : "a\\(b\\)c"', {OUT => 'b'}],
d5245cc
      ['bre2', '"a(" : "a("', {OUT => '2'}],
d5245cc
-- 
d5245cc
2.26.2
d5245cc