Skip to content

<regex>: integer overflow on large backreference value #2168

@pauldreik

Description

@pauldreik

The following simple program leads to a signed integer overflow inside _Do_digits

#include <regex>

int main() {
  std::regex regex{ "\\3333333334", std::regex_constants::ECMAScript };
}

Compiling with clang, using undefined behaviour sanitizer gives the following report:

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\include\regex:3965:14: runtime error: signed integer overflow: 333333333 * 10 cannot be represented in type 'int'

I verified this by using msvc and stopping in the debugger at the mentioned place in regex.

Expected behavior
I expected a std::regex_error exception to be thrown.

STL version
MSVC 16.11.2. I copied the latest regex from this repo into a local file, the same thing happened so it applies to the latest version as well.

Additional context
Both gcc 11 (with libstdc++) and clang 12 (with either libc++ or libstdc++) on linux throw a std::regex_error exception for this particular program (tested on godbolt). Here is a link: https://godbolt.org/z/obKn549da

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingfixedSomething works now, yay!

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions