MIME-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
Subject: sign extension bug in isc_regex_validate
Date: Sun, 13 Apr 2014 17:39:46 -0700
content-type: text/plain; charset="utf-8"
Message-ID: <3B0D8510-F414-4606-BDFB-E5B0F54F08C9@stanford.edu>
To: bind9-bugs@isc.org
Content-Transfer-Encoding: quoted-printable
From: David Ramos <daramos@stanford.edu>
Content-Length: 673

Hello,

Our UC-KLEE tool found a char-sign-extension bug in isc_regex_validate(), which may cause it to improperly accept or reject a regular expression depending on whether the compiler treated chars as signed or unsigned (either is allowed under the C specification). 

The offending code is in isc_regex_validate (lib/isc/regex.c) on line 258 in the latest git v9_9 HEAD:
  if (range == 2 && *c < range_start)

Some example inputs where the above condition may evaluate to true or false depending on the compiler are:
  \x5c-\x80
  \x83-\x02

The simplest fix is probably to change 'c' to an unsigned char, and possibly range_start to an unsigned int.

Thanks,
-David