Subject: regcomp() overwrites random memory
To: None <current-users@NetBSD.ORG>
From: Peter Simons <simons@petium.rhein.de>
List: current-users
Date: 01/04/1997 19:57:17
Hi,

after hours of testing and looking for the error in my program, I was
most surprised to find out that regcomp() is the faulty routine and
now I am curious whether I have discovered a bug in the the NetBSD 1.2
code or whether this behavior is a result of a bug in my own code.

What am I doing... I have to do various text re-writings and wrote a
routine TransformText() for my convenience:

 | RETURNCODE
 | TransformText(char *          dst_buffer,   /* Where to save the resulting string. */
 | 	      const char *    src_buffer,   /* Text to transform. */
 | 	      const char *    regex,        /* Regex to describe what matches. */
 | 	      const char *    rule)         /* How the result should look. */
 | {
 |     regex_t       preg;
 |     int           rc;
 | 
 | [...]
 | 
 |     /* Compile the regular expression. */
 | 
 |     debug((DEBUG_LIB, 1, "crashfile is \"%s\".", s_crash_filename));
 |     rc = regcomp(&preg, regex, REG_EXTENDED | REG_ICASE);
 |     debug((DEBUG_LIB, 1, "crashfile is \"%s\".", s_crash_filename));
 | 
 | [...]

In a completely different module of my source, I initialize a static
variable "s_crash_filename" with a buffer I malloc()ed earlier.

After I have called regcomp(), this buffer is overwritten with
garbage and I have absolutely no idea why. I added the two debug
statements and comment pretty much all other code out and I am sure
that it happens in regcomp(). I have no idea why, though.

To make things even more interesting: regcomp() overwrites the buffer
-only- when the regular expression pattern contains a '<' character, a
'>' character -- or both. Otherwise the routine works fine.

Any ideas anybody?