Yukihiro "Matz" Matsumoto 91b60802db mruby-regexp: cap character class count and free named_captures ...

Two related bugs uncovered by OSS-Fuzz testcase 6692915710853120:

1. add_class allowed unbounded growth of c->classes. Class IDs are
   stored in re_inst.a (uint8_t), so any ID >= 256 silently aliases
   another class via the cast at emit sites. Worse, c->class_capa
   (uint16_t) overflows on doubling past 32768 -> 0, then
   mrb_realloc(..., 0) returns NULL, and the next memset(&c->classes[id])
   segfaults at NULL+offset. Cap with RE_MAX_CLASSES = 256 (the encoding
   limit) and raise via compile_error past that.

2. Once the crash is fixed, the testcase exposes a leak of
   c->named_captures: compile_error frees c->code, c->classes, and
   c->stripped (commit 3f321f09bc) but missed named_captures. Add it
   to the same cleanup block.

Reported by OSS-Fuzz (clusterfuzz testcase 6692915710853120).

Co-authored-by: Claude <noreply@anthropic.com>

2026-05-08 10:32:03 +09:00

..

re_compile.c

mruby-regexp: cap character class count and free named_captures

2026-05-08 10:32:03 +09:00

re_exec.c

mruby-regexp: cache Pike VM state in pattern to avoid per-exec malloc

2026-04-23 19:25:34 +09:00

re_utf8.c

mruby-regexp: add built-in regexp engine with Pike VM

2026-04-23 19:25:27 +09:00

regexp.c

mruby-regexp: keep MatchData source/regexp GC-reachable

2026-04-23 19:25:39 +09:00