Boost C++ Libraries: Ticket #13036: Boost.Regex: Integer overflow during calculation of max_state_count

attachment set

Mon, 03 Jul 2017 21:50:13 GMT

attachment → bug_13036.cc

reproducer

Mon, 03 Jul 2017 21:51:54 GMT

I did not report this issue, but have attached a reproducer. A patch: https://github.com/boostorg/regex/pull/32.

FWIW, overflow occurs when the states variable is greater than sqrt(2^{31) (on a 32-bit platform).}

The value of the states variable is implementation dependent whenever re.size() returns a value greater than std::numeric_limits<std::ptrdiff_t>::max() (size() method returns a value of type std::size_t.)

component changed; owner set

John Maddock — Sun, 30 Jul 2017 18:19:54 GMT

owner set to John Maddock
component None → regex

Will investigate.

status changed; resolution set

John Maddock — Mon, 31 Jul 2017 18:20:02 GMT

status new → closed
resolution → fixed

Fixed in https://github.com/boostorg/regex/commit/bc9b25b5d3c3784543158510c6087d41739ab64a.

I didn't use your PR because the change from signed to unsigned integer introduces other pitfalls (signed/unsigned comparisons).