- cast GETNEXT to unsigned where it is being promoted to int to prevent
sign-extension (really it would have been better for PEEK*() and GETNEXT()
to return unsigned char; this would have removed a ton of (uch) casts, but
it is too intrusive for now).
- fix an isalpha that should have been iswalpha

Remove unneeded -D_OPENBSD_SOURCE

recognize the "C" language backslash escapes like gnu does (except b which
is already taken)

Arrange for tools build

add missing _

fix NLS compilation

Add glue to disable locale code in order to be smaller.

protect MIN from re-definition

reduce casts

sync with FreeBSD:
- NLS support
- GNU extensions
- bug fixes

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D10541

Fix OOB read from FreeBSD:

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

branches: 1.36.16;
use the unsigned char version of the input char in all cases "cap[uc]" to
avoid accessing cap[negative], found by Elliott Hughes

Use reallocarr and simplify. Document valid reallocation failures.

Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!

PR/45989: Martin Husemann: lint invocation does include -w only on i386

- turn lint -w for all the platforms after fixing the lint warnings.
- add _DIAGASSERTS() for casts that would assign values to types that
would not fit.
- change types, add casts
- change into ansii prototypes
- turn on _DIAGNOSTIC for libc (during current, to be eliminated for release
builds)

approved by core@

branches: 1.32.2; 1.32.6; 1.32.8;
if we don't have any sets yet, don't try to look in them.

branches: 1.31.2;
pass lint on i386

Prevent regcomp/regexec DoS attacks by limiting the amount of memory used
and the level of recursion. Thanks to Maksymilian Arciemowicz for discovery
and help with the implementation.

sign-compare fixes

branches: 1.28.22;
Rearrange headers for better portability.

ANSIfy.

Nuke __P.

remove unused label.

revert previous error check.

Coverity CID 769: Avoid NULL deref.

Coverity CID 770: Avoid NULL deref.

constify and remove __UNCONST.

WARNS=4

make othercase() return int rather than char, to avoid sign extension
bug with character codes >= 128

fixes PR lib/26986 by Alexander Becher

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Passing "char" values to ctype(3) functions is problematic.
If an argument of a ctype function is outside "unsigned char"
and if it is not EOF, the behavior is undefined.

The isascii(3) is the sole exception of above and it was used to
be used to check a value was valid for other ctype functions in
ancient systems. On modern systems, the ctype functions take
all values of "unsigned char", and this check is obsolete and
even wrong for non-ASCII systems. However, we leave the isascii()
untouched for now, so as not to change the current behavior.

branches: 1.16.4;
Delint.
Remove trailing ; from uses of __weak_alias(). The macro inserts this if
needed.

back out the #ifdef _DIAGNOSTIC argument checks; too many people complained.
_DIAGASSERT() is still retained.

* use _DIAGASSERT() to check pointer arguments against NULL and file
descriptors against -1 (as appropriate).
* add actual checks which to detect stuff that would trigger_DIAGASSERT(),
and attempt to return a sane error condition.
* knf some code
* remove some `register' decls.

the first two items result in the addition of code similar to the
following in various functions:

_DIAGASSERT(path != NULL)
#ifdef _DIAGNOSTIC
if (path == NULL) {
errno = EFAULT;
return (-1);
}
#endif

Minor size_t!=int related cleanup, only effective on the alpha.
btw: the maximum length of an RE is limited by the "int" range, also
on the alpha. "sopno" is "int", and "int"s are used as counters within
the code, so it would need some work to change this. I only don't know
how one could test it...

Change some function arguments to appropriate types. This makes lint
happy without casts.

Delint:
- we don't need to use longs; convert to use int32_t.
- remove break statements after returns.
- cast things properly.

constify some tables.

remove obsolete register declarations

If port provides __weak_alias(), provide an Standard C and POSIX pure
identifier namespace by renaming non standard functions and variables
such that they have a leading underscore. The library will use those
names internally. Weak aliases are used to provide the original names
to the API.

This is only the first part of this change. It is most of the functions
which are implemented in C for all NetBSD ports. Subsequent changes are
to add the same support to the remaining C files, to assembly files, and
to the automagically generated assembly source used for system calls.
When all of the above is done, ports with weak alias support should add
a definition for __weak_alias to <sys/cdefs.h>.

Fix RCSID's
Fix gcc warnings.
Add missing prototypes
#if 0 unused functions

add unintrusive Ids

clean up import; kill old cruft.

Upgrade regex routines to alpha3.4.

Upgrade regex routines to alpha3.3.

Update to Henry's Nov 2, 1993 alpha3.2 release.

branches: 1.1.1;
Henry Spencer's POSIX.2 compatibile regular expression matching routines.

Remove unneeded -D_OPENBSD_SOURCE

recognize the "C" language backslash escapes like gnu does (except b which
is already taken)

Arrange for tools build

add missing _

fix NLS compilation

Add glue to disable locale code in order to be smaller.

protect MIN from re-definition

reduce casts

sync with FreeBSD:
- NLS support
- GNU extensions
- bug fixes

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D10541

Fix OOB read from FreeBSD:

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

branches: 1.36.16;
use the unsigned char version of the input char in all cases "cap[uc]" to
avoid accessing cap[negative], found by Elliott Hughes

Use reallocarr and simplify. Document valid reallocation failures.

Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!

PR/45989: Martin Husemann: lint invocation does include -w only on i386

- turn lint -w for all the platforms after fixing the lint warnings.
- add _DIAGASSERTS() for casts that would assign values to types that
would not fit.
- change types, add casts
- change into ansii prototypes
- turn on _DIAGNOSTIC for libc (during current, to be eliminated for release
builds)

approved by core@

branches: 1.32.2; 1.32.6; 1.32.8;
if we don't have any sets yet, don't try to look in them.

branches: 1.31.2;
pass lint on i386

Prevent regcomp/regexec DoS attacks by limiting the amount of memory used
and the level of recursion. Thanks to Maksymilian Arciemowicz for discovery
and help with the implementation.

sign-compare fixes

branches: 1.28.22;
Rearrange headers for better portability.

ANSIfy.

Nuke __P.

remove unused label.

revert previous error check.

Coverity CID 769: Avoid NULL deref.

Coverity CID 770: Avoid NULL deref.

constify and remove __UNCONST.

WARNS=4

make othercase() return int rather than char, to avoid sign extension
bug with character codes >= 128

fixes PR lib/26986 by Alexander Becher

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Passing "char" values to ctype(3) functions is problematic.
If an argument of a ctype function is outside "unsigned char"
and if it is not EOF, the behavior is undefined.

The isascii(3) is the sole exception of above and it was used to
be used to check a value was valid for other ctype functions in
ancient systems. On modern systems, the ctype functions take
all values of "unsigned char", and this check is obsolete and
even wrong for non-ASCII systems. However, we leave the isascii()
untouched for now, so as not to change the current behavior.

branches: 1.16.4;
Delint.
Remove trailing ; from uses of __weak_alias(). The macro inserts this if
needed.

back out the #ifdef _DIAGNOSTIC argument checks; too many people complained.
_DIAGASSERT() is still retained.

* use _DIAGASSERT() to check pointer arguments against NULL and file
descriptors against -1 (as appropriate).
* add actual checks which to detect stuff that would trigger_DIAGASSERT(),
and attempt to return a sane error condition.
* knf some code
* remove some `register' decls.

the first two items result in the addition of code similar to the
following in various functions:

_DIAGASSERT(path != NULL)
#ifdef _DIAGNOSTIC
if (path == NULL) {
errno = EFAULT;
return (-1);
}
#endif

Minor size_t!=int related cleanup, only effective on the alpha.
btw: the maximum length of an RE is limited by the "int" range, also
on the alpha. "sopno" is "int", and "int"s are used as counters within
the code, so it would need some work to change this. I only don't know
how one could test it...

Change some function arguments to appropriate types. This makes lint
happy without casts.

Delint:
- we don't need to use longs; convert to use int32_t.
- remove break statements after returns.
- cast things properly.

constify some tables.

remove obsolete register declarations

If port provides __weak_alias(), provide an Standard C and POSIX pure
identifier namespace by renaming non standard functions and variables
such that they have a leading underscore. The library will use those
names internally. Weak aliases are used to provide the original names
to the API.

This is only the first part of this change. It is most of the functions
which are implemented in C for all NetBSD ports. Subsequent changes are
to add the same support to the remaining C files, to assembly files, and
to the automagically generated assembly source used for system calls.
When all of the above is done, ports with weak alias support should add
a definition for __weak_alias to <sys/cdefs.h>.

Fix RCSID's
Fix gcc warnings.
Add missing prototypes
#if 0 unused functions

add unintrusive Ids

clean up import; kill old cruft.

Upgrade regex routines to alpha3.4.

Upgrade regex routines to alpha3.3.

Update to Henry's Nov 2, 1993 alpha3.2 release.

branches: 1.1.1;
Henry Spencer's POSIX.2 compatibile regular expression matching routines.

recognize the "C" language backslash escapes like gnu does (except b which
is already taken)

Arrange for tools build

add missing _

fix NLS compilation

Add glue to disable locale code in order to be smaller.

protect MIN from re-definition

reduce casts

sync with FreeBSD:
- NLS support
- GNU extensions
- bug fixes

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D10541

Fix OOB read from FreeBSD:

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

branches: 1.36.16;
use the unsigned char version of the input char in all cases "cap[uc]" to
avoid accessing cap[negative], found by Elliott Hughes

Use reallocarr and simplify. Document valid reallocation failures.

Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!

PR/45989: Martin Husemann: lint invocation does include -w only on i386

- turn lint -w for all the platforms after fixing the lint warnings.
- add _DIAGASSERTS() for casts that would assign values to types that
would not fit.
- change types, add casts
- change into ansii prototypes
- turn on _DIAGNOSTIC for libc (during current, to be eliminated for release
builds)

approved by core@

branches: 1.32.2; 1.32.6; 1.32.8;
if we don't have any sets yet, don't try to look in them.

branches: 1.31.2;
pass lint on i386

Prevent regcomp/regexec DoS attacks by limiting the amount of memory used
and the level of recursion. Thanks to Maksymilian Arciemowicz for discovery
and help with the implementation.

sign-compare fixes

branches: 1.28.22;
Rearrange headers for better portability.

ANSIfy.

Nuke __P.

remove unused label.

revert previous error check.

Coverity CID 769: Avoid NULL deref.

Coverity CID 770: Avoid NULL deref.

constify and remove __UNCONST.

WARNS=4

make othercase() return int rather than char, to avoid sign extension
bug with character codes >= 128

fixes PR lib/26986 by Alexander Becher

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Passing "char" values to ctype(3) functions is problematic.
If an argument of a ctype function is outside "unsigned char"
and if it is not EOF, the behavior is undefined.

The isascii(3) is the sole exception of above and it was used to
be used to check a value was valid for other ctype functions in
ancient systems. On modern systems, the ctype functions take
all values of "unsigned char", and this check is obsolete and
even wrong for non-ASCII systems. However, we leave the isascii()
untouched for now, so as not to change the current behavior.

branches: 1.16.4;
Delint.
Remove trailing ; from uses of __weak_alias(). The macro inserts this if
needed.

back out the #ifdef _DIAGNOSTIC argument checks; too many people complained.
_DIAGASSERT() is still retained.

* use _DIAGASSERT() to check pointer arguments against NULL and file
descriptors against -1 (as appropriate).
* add actual checks which to detect stuff that would trigger_DIAGASSERT(),
and attempt to return a sane error condition.
* knf some code
* remove some `register' decls.

the first two items result in the addition of code similar to the
following in various functions:

_DIAGASSERT(path != NULL)
#ifdef _DIAGNOSTIC
if (path == NULL) {
errno = EFAULT;
return (-1);
}
#endif

Minor size_t!=int related cleanup, only effective on the alpha.
btw: the maximum length of an RE is limited by the "int" range, also
on the alpha. "sopno" is "int", and "int"s are used as counters within
the code, so it would need some work to change this. I only don't know
how one could test it...

Change some function arguments to appropriate types. This makes lint
happy without casts.

Delint:
- we don't need to use longs; convert to use int32_t.
- remove break statements after returns.
- cast things properly.

constify some tables.

remove obsolete register declarations

If port provides __weak_alias(), provide an Standard C and POSIX pure
identifier namespace by renaming non standard functions and variables
such that they have a leading underscore. The library will use those
names internally. Weak aliases are used to provide the original names
to the API.

This is only the first part of this change. It is most of the functions
which are implemented in C for all NetBSD ports. Subsequent changes are
to add the same support to the remaining C files, to assembly files, and
to the automagically generated assembly source used for system calls.
When all of the above is done, ports with weak alias support should add
a definition for __weak_alias to <sys/cdefs.h>.

Fix RCSID's
Fix gcc warnings.
Add missing prototypes
#if 0 unused functions

add unintrusive Ids

clean up import; kill old cruft.

Upgrade regex routines to alpha3.4.

Upgrade regex routines to alpha3.3.

Update to Henry's Nov 2, 1993 alpha3.2 release.

branches: 1.1.1;
Henry Spencer's POSIX.2 compatibile regular expression matching routines.

Arrange for tools build

add missing _

fix NLS compilation

Add glue to disable locale code in order to be smaller.

protect MIN from re-definition

reduce casts

sync with FreeBSD:
- NLS support
- GNU extensions
- bug fixes

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D10541

Fix OOB read from FreeBSD:

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

branches: 1.36.16;
use the unsigned char version of the input char in all cases "cap[uc]" to
avoid accessing cap[negative], found by Elliott Hughes

Use reallocarr and simplify. Document valid reallocation failures.

Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!

PR/45989: Martin Husemann: lint invocation does include -w only on i386

- turn lint -w for all the platforms after fixing the lint warnings.
- add _DIAGASSERTS() for casts that would assign values to types that
would not fit.
- change types, add casts
- change into ansii prototypes
- turn on _DIAGNOSTIC for libc (during current, to be eliminated for release
builds)

approved by core@

branches: 1.32.2; 1.32.6; 1.32.8;
if we don't have any sets yet, don't try to look in them.

branches: 1.31.2;
pass lint on i386

Prevent regcomp/regexec DoS attacks by limiting the amount of memory used
and the level of recursion. Thanks to Maksymilian Arciemowicz for discovery
and help with the implementation.

sign-compare fixes

branches: 1.28.22;
Rearrange headers for better portability.

ANSIfy.

Nuke __P.

remove unused label.

revert previous error check.

Coverity CID 769: Avoid NULL deref.

Coverity CID 770: Avoid NULL deref.

constify and remove __UNCONST.

WARNS=4

make othercase() return int rather than char, to avoid sign extension
bug with character codes >= 128

fixes PR lib/26986 by Alexander Becher

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Passing "char" values to ctype(3) functions is problematic.
If an argument of a ctype function is outside "unsigned char"
and if it is not EOF, the behavior is undefined.

The isascii(3) is the sole exception of above and it was used to
be used to check a value was valid for other ctype functions in
ancient systems. On modern systems, the ctype functions take
all values of "unsigned char", and this check is obsolete and
even wrong for non-ASCII systems. However, we leave the isascii()
untouched for now, so as not to change the current behavior.

branches: 1.16.4;
Delint.
Remove trailing ; from uses of __weak_alias(). The macro inserts this if
needed.

back out the #ifdef _DIAGNOSTIC argument checks; too many people complained.
_DIAGASSERT() is still retained.

* use _DIAGASSERT() to check pointer arguments against NULL and file
descriptors against -1 (as appropriate).
* add actual checks which to detect stuff that would trigger_DIAGASSERT(),
and attempt to return a sane error condition.
* knf some code
* remove some `register' decls.

the first two items result in the addition of code similar to the
following in various functions:

_DIAGASSERT(path != NULL)
#ifdef _DIAGNOSTIC
if (path == NULL) {
errno = EFAULT;
return (-1);
}
#endif

Minor size_t!=int related cleanup, only effective on the alpha.
btw: the maximum length of an RE is limited by the "int" range, also
on the alpha. "sopno" is "int", and "int"s are used as counters within
the code, so it would need some work to change this. I only don't know
how one could test it...

Change some function arguments to appropriate types. This makes lint
happy without casts.

Delint:
- we don't need to use longs; convert to use int32_t.
- remove break statements after returns.
- cast things properly.

constify some tables.

remove obsolete register declarations

If port provides __weak_alias(), provide an Standard C and POSIX pure
identifier namespace by renaming non standard functions and variables
such that they have a leading underscore. The library will use those
names internally. Weak aliases are used to provide the original names
to the API.

This is only the first part of this change. It is most of the functions
which are implemented in C for all NetBSD ports. Subsequent changes are
to add the same support to the remaining C files, to assembly files, and
to the automagically generated assembly source used for system calls.
When all of the above is done, ports with weak alias support should add
a definition for __weak_alias to <sys/cdefs.h>.

Fix RCSID's
Fix gcc warnings.
Add missing prototypes
#if 0 unused functions

add unintrusive Ids

clean up import; kill old cruft.

Upgrade regex routines to alpha3.4.

Upgrade regex routines to alpha3.3.

Update to Henry's Nov 2, 1993 alpha3.2 release.

branches: 1.1.1;
Henry Spencer's POSIX.2 compatibile regular expression matching routines.

add missing _

fix NLS compilation

Add glue to disable locale code in order to be smaller.

protect MIN from re-definition

reduce casts

sync with FreeBSD:
- NLS support
- GNU extensions
- bug fixes

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D10541

Fix OOB read from FreeBSD:

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

branches: 1.36.16;
use the unsigned char version of the input char in all cases "cap[uc]" to
avoid accessing cap[negative], found by Elliott Hughes

Use reallocarr and simplify. Document valid reallocation failures.

Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!

PR/45989: Martin Husemann: lint invocation does include -w only on i386

- turn lint -w for all the platforms after fixing the lint warnings.
- add _DIAGASSERTS() for casts that would assign values to types that
would not fit.
- change types, add casts
- change into ansii prototypes
- turn on _DIAGNOSTIC for libc (during current, to be eliminated for release
builds)

approved by core@

branches: 1.32.2; 1.32.6; 1.32.8;
if we don't have any sets yet, don't try to look in them.

branches: 1.31.2;
pass lint on i386

Prevent regcomp/regexec DoS attacks by limiting the amount of memory used
and the level of recursion. Thanks to Maksymilian Arciemowicz for discovery
and help with the implementation.

sign-compare fixes

branches: 1.28.22;
Rearrange headers for better portability.

ANSIfy.

Nuke __P.

remove unused label.

revert previous error check.

Coverity CID 769: Avoid NULL deref.

Coverity CID 770: Avoid NULL deref.

constify and remove __UNCONST.

WARNS=4

make othercase() return int rather than char, to avoid sign extension
bug with character codes >= 128

fixes PR lib/26986 by Alexander Becher

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Passing "char" values to ctype(3) functions is problematic.
If an argument of a ctype function is outside "unsigned char"
and if it is not EOF, the behavior is undefined.

The isascii(3) is the sole exception of above and it was used to
be used to check a value was valid for other ctype functions in
ancient systems. On modern systems, the ctype functions take
all values of "unsigned char", and this check is obsolete and
even wrong for non-ASCII systems. However, we leave the isascii()
untouched for now, so as not to change the current behavior.

branches: 1.16.4;
Delint.
Remove trailing ; from uses of __weak_alias(). The macro inserts this if
needed.

back out the #ifdef _DIAGNOSTIC argument checks; too many people complained.
_DIAGASSERT() is still retained.

* use _DIAGASSERT() to check pointer arguments against NULL and file
descriptors against -1 (as appropriate).
* add actual checks which to detect stuff that would trigger_DIAGASSERT(),
and attempt to return a sane error condition.
* knf some code
* remove some `register' decls.

the first two items result in the addition of code similar to the
following in various functions:

_DIAGASSERT(path != NULL)
#ifdef _DIAGNOSTIC
if (path == NULL) {
errno = EFAULT;
return (-1);
}
#endif

Minor size_t!=int related cleanup, only effective on the alpha.
btw: the maximum length of an RE is limited by the "int" range, also
on the alpha. "sopno" is "int", and "int"s are used as counters within
the code, so it would need some work to change this. I only don't know
how one could test it...

Change some function arguments to appropriate types. This makes lint
happy without casts.

Delint:
- we don't need to use longs; convert to use int32_t.
- remove break statements after returns.
- cast things properly.

constify some tables.

remove obsolete register declarations

If port provides __weak_alias(), provide an Standard C and POSIX pure
identifier namespace by renaming non standard functions and variables
such that they have a leading underscore. The library will use those
names internally. Weak aliases are used to provide the original names
to the API.

This is only the first part of this change. It is most of the functions
which are implemented in C for all NetBSD ports. Subsequent changes are
to add the same support to the remaining C files, to assembly files, and
to the automagically generated assembly source used for system calls.
When all of the above is done, ports with weak alias support should add
a definition for __weak_alias to <sys/cdefs.h>.

Fix RCSID's
Fix gcc warnings.
Add missing prototypes
#if 0 unused functions

add unintrusive Ids

clean up import; kill old cruft.

Upgrade regex routines to alpha3.4.

Upgrade regex routines to alpha3.3.

Update to Henry's Nov 2, 1993 alpha3.2 release.

branches: 1.1.1;
Henry Spencer's POSIX.2 compatibile regular expression matching routines.

protect MIN from re-definition

reduce casts

sync with FreeBSD:
- NLS support
- GNU extensions
- bug fixes

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D10541

Fix OOB read from FreeBSD:

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

branches: 1.36.16;
use the unsigned char version of the input char in all cases "cap[uc]" to
avoid accessing cap[negative], found by Elliott Hughes

Use reallocarr and simplify. Document valid reallocation failures.

Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!

PR/45989: Martin Husemann: lint invocation does include -w only on i386

- turn lint -w for all the platforms after fixing the lint warnings.
- add _DIAGASSERTS() for casts that would assign values to types that
would not fit.
- change types, add casts
- change into ansii prototypes
- turn on _DIAGNOSTIC for libc (during current, to be eliminated for release
builds)

approved by core@

branches: 1.32.2; 1.32.6; 1.32.8;
if we don't have any sets yet, don't try to look in them.

branches: 1.31.2;
pass lint on i386

Prevent regcomp/regexec DoS attacks by limiting the amount of memory used
and the level of recursion. Thanks to Maksymilian Arciemowicz for discovery
and help with the implementation.

sign-compare fixes

branches: 1.28.22;
Rearrange headers for better portability.

ANSIfy.

Nuke __P.

remove unused label.

revert previous error check.

Coverity CID 769: Avoid NULL deref.

Coverity CID 770: Avoid NULL deref.

constify and remove __UNCONST.

WARNS=4

make othercase() return int rather than char, to avoid sign extension
bug with character codes >= 128

fixes PR lib/26986 by Alexander Becher

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Passing "char" values to ctype(3) functions is problematic.
If an argument of a ctype function is outside "unsigned char"
and if it is not EOF, the behavior is undefined.

The isascii(3) is the sole exception of above and it was used to
be used to check a value was valid for other ctype functions in
ancient systems. On modern systems, the ctype functions take
all values of "unsigned char", and this check is obsolete and
even wrong for non-ASCII systems. However, we leave the isascii()
untouched for now, so as not to change the current behavior.

branches: 1.16.4;
Delint.
Remove trailing ; from uses of __weak_alias(). The macro inserts this if
needed.

back out the #ifdef _DIAGNOSTIC argument checks; too many people complained.
_DIAGASSERT() is still retained.

* use _DIAGASSERT() to check pointer arguments against NULL and file
descriptors against -1 (as appropriate).
* add actual checks which to detect stuff that would trigger_DIAGASSERT(),
and attempt to return a sane error condition.
* knf some code
* remove some `register' decls.

the first two items result in the addition of code similar to the
following in various functions:

_DIAGASSERT(path != NULL)
#ifdef _DIAGNOSTIC
if (path == NULL) {
errno = EFAULT;
return (-1);
}
#endif

Minor size_t!=int related cleanup, only effective on the alpha.
btw: the maximum length of an RE is limited by the "int" range, also
on the alpha. "sopno" is "int", and "int"s are used as counters within
the code, so it would need some work to change this. I only don't know
how one could test it...

Change some function arguments to appropriate types. This makes lint
happy without casts.

Delint:
- we don't need to use longs; convert to use int32_t.
- remove break statements after returns.
- cast things properly.

constify some tables.

remove obsolete register declarations

If port provides __weak_alias(), provide an Standard C and POSIX pure
identifier namespace by renaming non standard functions and variables
such that they have a leading underscore. The library will use those
names internally. Weak aliases are used to provide the original names
to the API.

This is only the first part of this change. It is most of the functions
which are implemented in C for all NetBSD ports. Subsequent changes are
to add the same support to the remaining C files, to assembly files, and
to the automagically generated assembly source used for system calls.
When all of the above is done, ports with weak alias support should add
a definition for __weak_alias to <sys/cdefs.h>.

Fix RCSID's
Fix gcc warnings.
Add missing prototypes
#if 0 unused functions

add unintrusive Ids

clean up import; kill old cruft.

Upgrade regex routines to alpha3.4.

Upgrade regex routines to alpha3.3.

Update to Henry's Nov 2, 1993 alpha3.2 release.

branches: 1.1.1;
Henry Spencer's POSIX.2 compatibile regular expression matching routines.

sync with FreeBSD:
- NLS support
- GNU extensions
- bug fixes

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D10541

Fix OOB read from FreeBSD:

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

branches: 1.36.16;
use the unsigned char version of the input char in all cases "cap[uc]" to
avoid accessing cap[negative], found by Elliott Hughes

Use reallocarr and simplify. Document valid reallocation failures.

Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!

PR/45989: Martin Husemann: lint invocation does include -w only on i386

- turn lint -w for all the platforms after fixing the lint warnings.
- add _DIAGASSERTS() for casts that would assign values to types that
would not fit.
- change types, add casts
- change into ansii prototypes
- turn on _DIAGNOSTIC for libc (during current, to be eliminated for release
builds)

approved by core@

branches: 1.32.2; 1.32.6; 1.32.8;
if we don't have any sets yet, don't try to look in them.

branches: 1.31.2;
pass lint on i386

Prevent regcomp/regexec DoS attacks by limiting the amount of memory used
and the level of recursion. Thanks to Maksymilian Arciemowicz for discovery
and help with the implementation.

sign-compare fixes

branches: 1.28.22;
Rearrange headers for better portability.

ANSIfy.

Nuke __P.

remove unused label.

revert previous error check.

Coverity CID 769: Avoid NULL deref.

Coverity CID 770: Avoid NULL deref.

constify and remove __UNCONST.

WARNS=4

make othercase() return int rather than char, to avoid sign extension
bug with character codes >= 128

fixes PR lib/26986 by Alexander Becher

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Passing "char" values to ctype(3) functions is problematic.
If an argument of a ctype function is outside "unsigned char"
and if it is not EOF, the behavior is undefined.

The isascii(3) is the sole exception of above and it was used to
be used to check a value was valid for other ctype functions in
ancient systems. On modern systems, the ctype functions take
all values of "unsigned char", and this check is obsolete and
even wrong for non-ASCII systems. However, we leave the isascii()
untouched for now, so as not to change the current behavior.

branches: 1.16.4;
Delint.
Remove trailing ; from uses of __weak_alias(). The macro inserts this if
needed.

back out the #ifdef _DIAGNOSTIC argument checks; too many people complained.
_DIAGASSERT() is still retained.

* use _DIAGASSERT() to check pointer arguments against NULL and file
descriptors against -1 (as appropriate).
* add actual checks which to detect stuff that would trigger_DIAGASSERT(),
and attempt to return a sane error condition.
* knf some code
* remove some `register' decls.

the first two items result in the addition of code similar to the
following in various functions:

_DIAGASSERT(path != NULL)
#ifdef _DIAGNOSTIC
if (path == NULL) {
errno = EFAULT;
return (-1);
}
#endif

Minor size_t!=int related cleanup, only effective on the alpha.
btw: the maximum length of an RE is limited by the "int" range, also
on the alpha. "sopno" is "int", and "int"s are used as counters within
the code, so it would need some work to change this. I only don't know
how one could test it...

Change some function arguments to appropriate types. This makes lint
happy without casts.

Delint:
- we don't need to use longs; convert to use int32_t.
- remove break statements after returns.
- cast things properly.

constify some tables.

remove obsolete register declarations

If port provides __weak_alias(), provide an Standard C and POSIX pure
identifier namespace by renaming non standard functions and variables
such that they have a leading underscore. The library will use those
names internally. Weak aliases are used to provide the original names
to the API.

This is only the first part of this change. It is most of the functions
which are implemented in C for all NetBSD ports. Subsequent changes are
to add the same support to the remaining C files, to assembly files, and
to the automagically generated assembly source used for system calls.
When all of the above is done, ports with weak alias support should add
a definition for __weak_alias to <sys/cdefs.h>.

Fix RCSID's
Fix gcc warnings.
Add missing prototypes
#if 0 unused functions

add unintrusive Ids

clean up import; kill old cruft.

Upgrade regex routines to alpha3.4.

Upgrade regex routines to alpha3.3.

Update to Henry's Nov 2, 1993 alpha3.2 release.

branches: 1.1.1;
Henry Spencer's POSIX.2 compatibile regular expression matching routines.

Add some better error handling from FreeBSD, although we don't
suffer from the same issue, since we don't decrement p->next, like
FreeBSD does because we don't have multibyte support (yet). We
choose to do this so we can fail faster and more predictably.

Here's the original FreeBSD message:

When passed the invalid regular expression "a**", the error is
eventually detected and seterr() is called. It sets p->error
appropriatly and p->next and p->end to nuls which is a never used char
nuls[10] which is zeros due to .bss initialization. Unfortunatly,
p_ere_exp() and p_simp_re() both have fall through cases where they set
the error, decrement p->next and access it which means a read from what
ever .bss variable comes before nuls.

Found with regex_test:repet_multi and CHERI bounds checking.

Reviewed by: ngie, pfg, emaste
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D10541

Fix OOB read from FreeBSD:

The bug is an out-of-bounds read detected with address sanitizer that
happens when 'sp' in p_b_coll_elems() includes NUL byte[s], e.g. if it's
equal to "GS\x00". In that case len will be equal to 4, and the
strncmp(cp->name, sp, len) call will succeed when cp->name is "GS" but the
cp->name[len] == '\0' comparison will cause the read to go out-of-bounds.

Checking the length using strlen() instead eliminates the issue.

The bug was found in LLVM with oss-fuzz:
https://reviews.llvm.org/D39380

use the unsigned char version of the input char in all cases "cap[uc]" to
avoid accessing cap[negative], found by Elliott Hughes

Use reallocarr and simplify. Document valid reallocation failures.

Add and use reallocarray() to prevent a multiplication overflow in allocation.
Reported by Guido Vranken, thanks!

PR/45989: Martin Husemann: lint invocation does include -w only on i386

- turn lint -w for all the platforms after fixing the lint warnings.
- add _DIAGASSERTS() for casts that would assign values to types that
would not fit.
- change types, add casts
- change into ansii prototypes
- turn on _DIAGNOSTIC for libc (during current, to be eliminated for release
builds)

approved by core@

branches: 1.32.2; 1.32.6; 1.32.8;
if we don't have any sets yet, don't try to look in them.

branches: 1.31.2;
pass lint on i386

Prevent regcomp/regexec DoS attacks by limiting the amount of memory used
and the level of recursion. Thanks to Maksymilian Arciemowicz for discovery
and help with the implementation.

sign-compare fixes

branches: 1.28.22;
Rearrange headers for better portability.

ANSIfy.

Nuke __P.

remove unused label.

revert previous error check.

Coverity CID 769: Avoid NULL deref.

Coverity CID 770: Avoid NULL deref.

constify and remove __UNCONST.

WARNS=4

make othercase() return int rather than char, to avoid sign extension
bug with character codes >= 128

fixes PR lib/26986 by Alexander Becher

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22280, verified by myself.

Passing "char" values to ctype(3) functions is problematic.
If an argument of a ctype function is outside "unsigned char"
and if it is not EOF, the behavior is undefined.

The isascii(3) is the sole exception of above and it was used to
be used to check a value was valid for other ctype functions in
ancient systems. On modern systems, the ctype functions take
all values of "unsigned char", and this check is obsolete and
even wrong for non-ASCII systems. However, we leave the isascii()
untouched for now, so as not to change the current behavior.

branches: 1.16.4;
Delint.
Remove trailing ; from uses of __weak_alias(). The macro inserts this if
needed.

back out the #ifdef _DIAGNOSTIC argument checks; too many people complained.
_DIAGASSERT() is still retained.

* use _DIAGASSERT() to check pointer arguments against NULL and file
descriptors against -1 (as appropriate).
* add actual checks which to detect stuff that would trigger_DIAGASSERT(),
and attempt to return a sane error condition.
* knf some code
* remove some `register' decls.

the first two items result in the addition of code similar to the
following in various functions:

_DIAGASSERT(path != NULL)
#ifdef _DIAGNOSTIC
if (path == NULL) {
errno = EFAULT;
return (-1);
}
#endif

Minor size_t!=int related cleanup, only effective on the alpha.
btw: the maximum length of an RE is limited by the "int" range, also
on the alpha. "sopno" is "int", and "int"s are used as counters within
the code, so it would need some work to change this. I only don't know
how one could test it...

Change some function arguments to appropriate types. This makes lint
happy without casts.

Delint:
- we don't need to use longs; convert to use int32_t.
- remove break statements after returns.
- cast things properly.

constify some tables.

remove obsolete register declarations

If port provides __weak_alias(), provide an Standard C and POSIX pure
identifier namespace by renaming non standard functions and variables
such that they have a leading underscore. The library will use those
names internally. Weak aliases are used to provide the original names
to the API.

This is only the first part of this change. It is most of the functions
which are implemented in C for all NetBSD ports. Subsequent changes are
to add the same support to the remaining C files, to assembly files, and
to the automagically generated assembly source used for system calls.
When all of the above is done, ports with weak alias support should add
a definition for __weak_alias to <sys/cdefs.h>.

Fix RCSID's
Fix gcc warnings.
Add missing prototypes
#if 0 unused functions

add unintrusive Ids

clean up import; kill old cruft.

Upgrade regex routines to alpha3.4.

Upgrade regex routines to alpha3.3.

Update to Henry's Nov 2, 1993 alpha3.2 release.

branches: 1.1.1;
Henry Spencer's POSIX.2 compatibile regular expression matching routines.