1 files changed, 49 insertions, 50 deletions

diff --git a/gl/regex_internal.c b/gl/regex_internal.c
index 98b8d5d2..899b0ae6 100644
--- a/gl/regex_internal.c
+++ b/gl/regex_internal.c
@@ -1,22 +1,21 @@
 /* Extended regular expression matching and search library.
-   Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Free
-   Software Foundation, Inc.
+   Copyright (C) 2002-2013 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Isamu Hasegawa <isamu@yamato.ibm.com>.
 
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3, or (at your option)
-   any later version.
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public
+   License as published by the Free Software Foundation; either
+   version 3 of the License, or (at your option) any later version.
 
-   This program is distributed in the hope that it will be useful,
+   The GNU C Library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
 
-   You should have received a copy of the GNU General Public License along
-   with this program; if not, write to the Free Software Foundation,
-   Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */
+   You should have received a copy of the GNU General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
 
 static void re_string_construct_common (const char *str, Idx len,
                                         re_string_t *pstr,
@@ -135,9 +134,9 @@ re_string_realloc_buffers (re_string_t *pstr, Idx new_buf_len)
     {
       wint_t *new_wcs;
 
-      /* Avoid overflow.  */
-      size_t max_object_size = MAX (sizeof (wint_t), sizeof (Idx));
-      if (BE (SIZE_MAX / max_object_size < new_buf_len, 0))
+      /* Avoid overflow in realloc.  */
+      const size_t max_object_size = MAX (sizeof (wint_t), sizeof (Idx));
+      if (BE (MIN (IDX_MAX, SIZE_MAX / max_object_size) < new_buf_len, 0))
         return REG_ESPACE;
 
       new_wcs = re_realloc (pstr->wcs, wint_t, new_buf_len);
@@ -237,13 +236,8 @@ build_wcs_buffer (re_string_t *pstr)
       else
         p = (const char *) pstr->raw_mbs + pstr->raw_mbs_idx + byte_idx;
       mbclen = __mbrtowc (&wc, p, remain_len, &pstr->cur_state);
-      if (BE (mbclen == (size_t) -2, 0))
-        {
-          /* The buffer doesn't have enough space, finish to build.  */
-          pstr->cur_state = prev_st;
-          break;
-        }
-      else if (BE (mbclen == (size_t) -1 || mbclen == 0, 0))
+      if (BE (mbclen == (size_t) -1 || mbclen == 0
+              || (mbclen == (size_t) -2 && pstr->bufs_len >= pstr->len), 0))
         {
           /* We treat these cases as a singlebyte character.  */
           mbclen = 1;
@@ -252,6 +246,12 @@ build_wcs_buffer (re_string_t *pstr)
             wc = pstr->trans[wc];
           pstr->cur_state = prev_st;
         }
+      else if (BE (mbclen == (size_t) -2, 0))
+        {
+          /* The buffer doesn't have enough space, finish to build.  */
+          pstr->cur_state = prev_st;
+          break;
+        }
 
       /* Write wide character and padding.  */
       pstr->wcs[byte_idx++] = wc;
@@ -334,9 +334,11 @@ build_wcs_upper_buffer (re_string_t *pstr)
               for (remain_len = byte_idx + mbclen - 1; byte_idx < remain_len ;)
                 pstr->wcs[byte_idx++] = WEOF;
             }
-          else if (mbclen == (size_t) -1 || mbclen == 0)
+          else if (mbclen == (size_t) -1 || mbclen == 0
+                   || (mbclen == (size_t) -2 && pstr->bufs_len >= pstr->len))
             {
-              /* It is an invalid character or '\0'.  Just use the byte.  */
+              /* It is an invalid character, an incomplete character
+                 at the end of the string, or '\0'.  Just use the byte.  */
               int ch = pstr->raw_mbs[pstr->raw_mbs_idx + byte_idx];
               pstr->mbs[byte_idx] = ch;
               /* And also cast it to wide char.  */
@@ -449,7 +451,8 @@ build_wcs_upper_buffer (re_string_t *pstr)
             for (remain_len = byte_idx + mbclen - 1; byte_idx < remain_len ;)
               pstr->wcs[byte_idx++] = WEOF;
           }
-        else if (mbclen == (size_t) -1 || mbclen == 0)
+        else if (mbclen == (size_t) -1 || mbclen == 0
+                 || (mbclen == (size_t) -2 && pstr->bufs_len >= pstr->len))
           {
             /* It is an invalid character or '\0'.  Just use the byte.  */
             int ch = pstr->raw_mbs[pstr->raw_mbs_idx + src_idx];
@@ -496,8 +499,7 @@ re_string_skip_chars (re_string_t *pstr, Idx new_raw_idx, wint_t *last_wc)
        rawbuf_idx < new_raw_idx;)
     {
       wchar_t wc2;
-      Idx remain_len;
-      remain_len = pstr->len - rawbuf_idx;
+      Idx remain_len = pstr->raw_len - rawbuf_idx;
       prev_st = pstr->cur_state;
       mbclen = __mbrtowc (&wc2, (const char *) pstr->raw_mbs + rawbuf_idx,
                           remain_len, &pstr->cur_state);
@@ -733,21 +735,21 @@ re_string_reconstruct (re_string_t *pstr, Idx idx, int eflags)
                           mbstate_t cur_state;
                           wchar_t wc2;
                           Idx mlen = raw + pstr->len - p;
+                          unsigned char buf[6];
                           size_t mbclen;
 
-#if 0 /* dead code: buf is set but never used */
-                          unsigned char buf[6];
+                          const unsigned char *pp = p;
                           if (BE (pstr->trans != NULL, 0))
                             {
                               int i = mlen < 6 ? mlen : 6;
                               while (--i >= 0)
                                 buf[i] = pstr->trans[p[i]];
+                              pp = buf;
                             }
-#endif
                           /* XXX Don't use mbrtowc, we know which conversion
                              to use (UTF-8 -> UCS4).  */
                           memset (&cur_state, 0, sizeof (cur_state));
-                          mbclen = __mbrtowc (&wc2, (const char *) p, mlen,
+                          mbclen = __mbrtowc (&wc2, (const char *) pp, mlen,
                                               &cur_state);
                           if (raw + offset - p <= mbclen
                               && mbclen < (size_t) -2)
@@ -832,7 +834,7 @@ re_string_reconstruct (re_string_t *pstr, Idx idx, int eflags)
 }
 
 static unsigned char
-internal_function __attribute ((pure))
+internal_function __attribute__ ((pure))
 re_string_peek_byte_case (const re_string_t *pstr, Idx idx)
 {
   int ch;
@@ -869,7 +871,7 @@ re_string_peek_byte_case (const re_string_t *pstr, Idx idx)
 }
 
 static unsigned char
-internal_function __attribute ((pure))
+internal_function
 re_string_fetch_byte_case (re_string_t *pstr)
 {
   if (BE (!pstr->mbs_allocated, 1))
@@ -972,7 +974,7 @@ re_node_set_alloc (re_node_set *set, Idx size)
   set->alloc = size;
   set->nelem = 0;
   set->elems = re_malloc (Idx, size);
-  if (BE (set->elems == NULL, 0))
+  if (BE (set->elems == NULL, 0) && (MALLOC_0_IS_NONNULL || size != 0))
     return REG_ESPACE;
   return REG_NOERROR;
 }
@@ -1352,7 +1354,7 @@ re_node_set_insert_last (re_node_set *set, Idx elem)
    Return true if SET1 and SET2 are equivalent.  */
 
 static bool
-internal_function __attribute ((pure))
+internal_function __attribute__ ((pure))
 re_node_set_compare (const re_node_set *set1, const re_node_set *set2)
 {
   Idx i;
@@ -1367,7 +1369,7 @@ re_node_set_compare (const re_node_set *set1, const re_node_set *set2)
 /* Return (idx + 1) if SET contains the element ELEM, return 0 otherwise.  */
 
 static Idx
-internal_function __attribute ((pure))
+internal_function __attribute__ ((pure))
 re_node_set_contains (const re_node_set *set, Idx elem)
 {
   __re_size_t idx, right, mid;
@@ -1413,13 +1415,12 @@ re_dfa_add_node (re_dfa_t *dfa, re_token_t token)
       Idx *new_nexts, *new_indices;
       re_node_set *new_edests, *new_eclosures;
       re_token_t *new_nodes;
-      size_t max_object_size =
-        MAX (sizeof (re_token_t),
-             MAX (sizeof (re_node_set),
-                  sizeof (Idx)));
 
-      /* Avoid overflows.  */
-      if (BE (SIZE_MAX / 2 / max_object_size < dfa->nodes_alloc, 0))
+      /* Avoid overflows in realloc.  */
+      const size_t max_object_size = MAX (sizeof (re_token_t),
+                                          MAX (sizeof (re_node_set),
+                                               sizeof (Idx)));
+      if (BE (MIN (IDX_MAX, SIZE_MAX / max_object_size) < new_nodes_alloc, 0))
         return REG_MISSING;
 
       new_nodes = re_realloc (dfa->nodes, re_token_t, new_nodes_alloc);
@@ -1442,11 +1443,9 @@ re_dfa_add_node (re_dfa_t *dfa, re_token_t token)
   dfa->nodes[dfa->nodes_len] = token;
   dfa->nodes[dfa->nodes_len].constraint = 0;
 #ifdef RE_ENABLE_I18N
-  {
-  int type = token.type;
   dfa->nodes[dfa->nodes_len].accept_mb =
-    (type == OP_PERIOD && dfa->mb_cur_max > 1) || type == COMPLEX_BRACKET;
-  }
+    ((token.type == OP_PERIOD && dfa->mb_cur_max > 1)
+     || token.type == COMPLEX_BRACKET);
 #endif
   dfa->nexts[dfa->nodes_len] = REG_MISSING;
   re_node_set_init_empty (dfa->edests + dfa->nodes_len);
@@ -1454,7 +1453,7 @@ re_dfa_add_node (re_dfa_t *dfa, re_token_t token)
   return dfa->nodes_len++;
 }
 
-static inline re_hashval_t
+static re_hashval_t
 internal_function
 calc_state_hash (const re_node_set *nodes, unsigned int context)
 {
@@ -1551,7 +1550,7 @@ re_acquire_state_context (reg_errcode_t *err, const re_dfa_t *dfa,
           && re_node_set_compare (state->entrance_nodes, nodes))
         return state;
     }
-  /* There are no appropriate state in `dfa', create the new one.  */
+  /* There are no appropriate state in 'dfa', create the new one.  */
   new_state = create_cd_newstate (dfa, nodes, context, hash);
   if (BE (new_state == NULL, 0))
     *err = REG_ESPACE;
@@ -1580,7 +1579,7 @@ register_state (const re_dfa_t *dfa, re_dfastate_t *newstate,
     {
       Idx elem = newstate->nodes.elems[i];
       if (!IS_EPSILON_NODE (dfa->nodes[elem].type))
-        if (BE (! re_node_set_insert_last (&newstate->non_eps_nodes, elem), 0))
+        if (! re_node_set_insert_last (&newstate->non_eps_nodes, elem))
           return REG_ESPACE;
     }
 
@@ -1615,7 +1614,7 @@ free_state (re_dfastate_t *state)
   re_free (state);
 }
 
-/* Create the new state which is independ of contexts.
+/* Create the new state which is independent of contexts.
    Return the new state if succeeded, otherwise return NULL.  */
 
 static re_dfastate_t *