mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
479af5c1bd
The first-byte bitmap (bm[16]) is intentionally ASCII-only (include/re_internal.h:75 documents it as 128 bits / ASCII), and the matcher at re_exec.c:39 short-circuits for bytes >= 128. But first_set_walk's RE_CHAR case wrote bm[a >> 3] without checking a, overflowing the 16-byte stack buffer for any pattern containing a byte >= 128. When a >= 128, return FALSE so compute_first_set marks the filter unusable, matching the bail-out pattern already used for RE_NCLASS and RE_ANY. The pattern still compiles and matches; only the first-byte optimization is skipped. Reported by OSS-Fuzz (clusterfuzz testcase 4909069193510912). Co-authored-by: Claude <noreply@anthropic.com>