Opened 5 years ago
Closed 5 years ago
#13034 closed Bugs (fixed)
Infinite loop when counter overflows
Reported by: | Owned by: | John Maddock | |
---|---|---|---|
Milestone: | To Be Determined | Component: | regex |
Version: | Boost 1.66.0 | Severity: | Problem |
Keywords: | Cc: |
Description
Hi,
In function bool perl_matcher<BidiIterator, Allocator, traits>::match_dot_repeat_slow()
variable 'count' can overflow since it's defined as unsigned int and rep->max is std::size_t initialized to numeric limits max.
while(count < rep->max) {
pstate = psingle; if(!match_wild())
break;
++count;
}
On Red Hat 6.7, 64 bit, unsigned int it 32 bit while size_t is 64 bit.
Note:
See TracTickets
for help on using tickets.
Fixed in https://github.com/boostorg/regex/commit/d97bcfb5dd6b4418040b776f33a9342a4b2b6b75
Thanks!