Skip to content

Commit 33898de

Browse files
committed
syntax: fix bug in new alternation literal analysis
In the rewrite of this area of the code, I got part of the logic wrong. This bug was thankfully detected by OSS-fuzz before the release went out! Ref https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58173
1 parent cf8751a commit 33898de

File tree

3 files changed

+13
-3
lines changed

3 files changed

+13
-3
lines changed

regex-syntax/src/hir/mod.rs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2072,8 +2072,8 @@ impl Properties {
20722072
/// concatenation of only `Literal`s or an alternation of only `Literal`s.
20732073
///
20742074
/// For example, `f`, `foo`, `a|b|c`, and `foo|bar|baz` are alternation
2075-
/// literals, but `f+`, `(foo)`, `foo()`, ``
2076-
/// are not (even though that contain sub-expressions that are literals).
2075+
/// literals, but `f+`, `(foo)`, `foo()`, and the empty pattern are not
2076+
/// (even though that contain sub-expressions that are literals).
20772077
#[inline]
20782078
pub fn is_alternation_literal(&self) -> bool {
20792079
self.0.alternation_literal
@@ -2211,7 +2211,7 @@ impl Properties {
22112211
props.static_explicit_captures_len = None;
22122212
}
22132213
props.alternation_literal =
2214-
props.alternation_literal && p.is_alternation_literal();
2214+
props.alternation_literal && p.is_literal();
22152215
if !min_poisoned {
22162216
if let Some(xmin) = p.minimum_len() {
22172217
if props.minimum_len.map_or(true, |pmin| xmin < pmin) {

regex-syntax/src/hir/translate.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3480,6 +3480,7 @@ mod tests {
34803480
assert!(!props(r"a|[b]").is_alternation_literal());
34813481
assert!(!props(r"(?:a)|b").is_alternation_literal());
34823482
assert!(!props(r"a|(?:b)").is_alternation_literal());
3483+
assert!(!props(r"(?:z|xx)@|xx").is_alternation_literal());
34833484
}
34843485

34853486
// This tests that the smart Hir::concat constructor simplifies the given

tests/regression_fuzz.rs

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,12 @@ fn big_regex_fails_to_compile() {
2929
let pat = "[\u{0}\u{e}\u{2}\\w~~>[l\t\u{0}]p?<]{971158}";
3030
assert!(regex_new!(pat).is_err());
3131
}
32+
33+
// This was caught while on master but before a release went out(!).
34+
//
35+
// See: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58173
36+
#[test]
37+
fn todo() {
38+
let pat = "(?:z|xx)@|xx";
39+
assert!(regex_new!(pat).is_ok());
40+
}

0 commit comments

Comments
 (0)