stack overflow in regex

Hi Felix,

you=E2=80=99ll almost certainly want this:

Description: fix regex stack overflow
 this only caused an FTBFS due to a testsuite failure on alpha
 but overwrote the stack on any architecture
Author: mirabilos <[email protected]>

--- a/libregex/rx.c
+++ b/libregex/rx.c
@@ -344,11 +344,11 @@ static int matchpiece(void*__restrict__
   unsigned int *offsets;
   assert(a->max>0 && a->max<1000);
 #ifdef DEBUG
-  printf("alloca(%d)\n",sizeof(int)*a->max);
+  printf("alloca(%d)\n",sizeof(int)*(a->max+1));
 #endif
-  offsets=3Dalloca(sizeof(int)*a->max);
+  offsets=3Dalloca(sizeof(int)*(a->max+1));
   offsets[0]=3D0;
-//  printf("allocating %d offsets...\n",a->max);
+//  printf("allocating %d offsets...\n",a->max+1);
 //  printf("matchpiece \"%s\"...\n",s);
   /* first, try to match the atom as often as possible, up to a->max times=
 */
   if (a->max =3D=3D 1 && a->min =3D=3D 1)


The FTBFS was reproducible with a testcase reduced to
  assert(regcomp(&r,"[0-9]{8}",REG_EXTENDED)=3D=3D0);
  assert(regexec(&r,"12345678",0,0,0)=3D=3D0);
  regfree(&r);
and did not hit with {1} or {7} or (after extending the
test string) {9} probably due to alignment issues. It
also only crashed on alpha, probably because the stack
space overwritten on all other architectures was in=E2=80=90
significant.

Special thanks to Michael for getting me a test account
on an alpha. (Now I=E2=80=99ll have a SIGBUS elsewhere to find.)

bye,
//mirabilos
--=20
Yes, I hate users and I want them to suffer.
=09-- Marco d'Itri on gmane.linux.debian.devel.general