The compiler in the bundled regular expression library allows any character to end a POSIX character class expression. Besides incorrect parsing, this can involve skipping the string terminator in the face of a malformed expression.
Test case:
#include "jimregexp.h" int main (void) { regex_t r; return !regcomp (&r, "[[:digit:\0]", 0); }
Trivial fix:
diff --git a/regexp/jimregexp.c b/regexp/jimregexp.c index 7fd6d473e..1a8b8aae6 100644 --- a/regexp/jimregexp.c +++ b/regexp/jimregexp.c @@ -795,7 +795,8 @@ static int regatom(regex_t *preg, int *flagp) for (cc = 0; cc < CC_NUM; cc++) { n = strlen(character_class[cc]); - if (strncmp(pattern, character_class[cc], n) == 0) { + if (strncmp(pattern, character_class[cc], n) == 0 + && pattern[n] == ']') { /* Found a character class */ pattern += n + 1; break;
I have not investigated whether this has any impact on current versions of GnuPG.