From f4258aaed02ee7be761f2499b0b6243a8f37b7cb Mon Sep 17 00:00:00 2001 From: John Hawthorn Date: Tue, 12 Nov 2024 09:04:21 -0800 Subject: [PATCH] [Bug #20886] Avoid double-free in regex timeout after stack_double (#12063) Fix regex timeout double-free after stack_double As of 10574857ce167869524b97ee862b610928f6272f, it's possible to crash on a double free due to `stk_alloc` AKA `msa->stack_p` being freed twice, once at the end of match_at and a second time in `FREE_MATCH_ARG` in the parent caller. Fixes [Bug #20886] --- regexec.c | 3 +-- test/ruby/test_regexp.rb | 7 +++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/regexec.c b/regexec.c index bae338cb78..22c1ad050d 100644 --- a/regexec.c +++ b/regexec.c @@ -4217,9 +4217,8 @@ match_at(regex_t* reg, const UChar* str, const UChar* end, return ONIGERR_UNEXPECTED_BYTECODE; timeout: + STACK_SAVE; xfree(xmalloc_base); - if (stk_base != stk_alloc || IS_NOT_NULL(msa->stack_p)) - xfree(stk_base); return ONIGERR_TIMEOUT; } diff --git a/test/ruby/test_regexp.rb b/test/ruby/test_regexp.rb index 6b9efcb555..010be01960 100644 --- a/test/ruby/test_regexp.rb +++ b/test/ruby/test_regexp.rb @@ -1838,6 +1838,13 @@ class TestRegexp < Test::Unit::TestCase end; end + def test_bug_20886 + re = Regexp.new("d()*+|a*a*bc", timeout: 0.02) + assert_raise(Regexp::TimeoutError) do + re === "b" + "a" * 1000 + end + end + def per_instance_redos_test(global_timeout, per_instance_timeout, expected_timeout) assert_separately([], "#{<<-"begin;"}\n#{<<-'end;'}") global_timeout = #{ EnvUtil.apply_timeout_scale(global_timeout).inspect }