Fix UB - signed integer overflow in regex. Thanks to Tim Shen for the patch. Reviewed as https://reviews.llvm.org/D39066

git-svn-id: https://llvm.org/svn/llvm-project/libcxx/trunk@316172 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-19 17:39:16 +00:00
parent 2ac694b611
commit 278c0ba4a6
2 changed files with 42 additions and 0 deletions
--- a/include/regex
+++ b/include/regex
@@ -4064,6 +4064,8 @@ basic_regex<_CharT, _Traits>::__parse_DUP_COUNT(_ForwardIterator __first,
                 __first != __last && ( __val = __traits_.value(*__first, 10)) != -1;
                 ++__first)
            {
+                if (__c >= std::numeric_limits<int>::max() / 10)
+                    __throw_regex_error<regex_constants::error_badbrace>();
                __c *= 10;
                __c += __val;
            }