basic_regex class constructor invalid memory read

[Yang Dingning <yangdingning@…>]

Compile and run the following code:

#include <boost/regex.hpp>

int main()
{
	boost::regex reg("(\\w++{3})*");
	return 0;
}

This would cause boost to read from invalid memory and crash the program, leading to denial of service.

The bug has been verified to exist in Boost 1.46.1, and also in trunk code as of Jun. 9.

[anonymous]

Confirmed, this and the other issue you reported will be fixed in Trunk shortly (too late for 1.47 though I'm afraid).

I'm curious, if it's not a secret, how did you manage to find these?

[John Maddock]

(In [72612]) Fix infinite recursion in bad recursive expressions. Fix bug that allows invalid regex to go unnoticed and crash later. Fixes #5613. Fixes #5612.

[Yang Dingning <yangdingning@…>]

Sorry for the late reply, haven't checked the mailbox for a while :-)
We are currently carrying out fuzz testings to evaluate the stability and security of major regular expression engines. The above two testcases are generated by the fuzzing tool.