| Subject: | sign extension bug in isc_regex_validate |
| Date: | Sun, 13 Apr 2014 17:39:46 -0700 |
| To: | bind9-bugs@isc.org |
| From: | David Ramos <daramos@stanford.edu> |
Hello,
Our UC-KLEE tool found a char-sign-extension bug in isc_regex_validate(), which may cause it to improperly accept or reject a regular expression depending on whether the compiler treated chars as signed or unsigned (either is allowed under the C specification).
The offending code is in isc_regex_validate (lib/isc/regex.c) on line 258 in the latest git v9_9 HEAD:
if (range == 2 && *c < range_start)
Some example inputs where the above condition may evaluate to true or false depending on the compiler are:
\x5c-\x80
\x83-\x02
The simplest fix is probably to change 'c' to an unsigned char, and possibly range_start to an unsigned int.
Thanks,
-David