[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CADdoe42C2ZFwdaPNeQ4WaC6gqaZactQhNc2KXSt+ruLgaQ-WaQ@mail.gmail.com>
Date: Mon, 26 Oct 2026 05:35:06 -0700
From: Thai Duong <thai@...if.io>
To: musl@...ts.openwall.com
Subject: [SECURITY] musl: out-of-bounds read in regexec() backtracking
(src/regex/regexec.c, 1.2.6)
Hello,
Calif.io, working with Anthropic, is reporting a memory-safety issue
in musl's regex matcher. In tre_tnfa_run_backtrack()
(src/regex/regexec.c), the backtracking retry path rolls back the
match state but not pos_add_next, so after a retry GET_NEXT_WCHAR
advances the byte position by a stale length. On a subject that mixes
single-byte and multibyte characters the recorded byte offsets desync
and the final strncmp (regexec.c:785) reads past the end of the
subject buffer. It is reachable through the exported regexec() when
the application uses a backreference pattern and passes an
attacker-controlled subject string, which regexec is documented to
accept. It is present at v1.2.6 and master.
The full write-up and a source-level reproduction are in the attached
report, and the proof of concept is attached as ANT-2026-HMXB71C3.zip
and also mirrored at
https://drive.google.com/file/d/1AUXONoLV-U5XDuOvLk9IbjEEiRR8cI1p/view.
This issue was found by Claude and verified by Calif.io engineers. Our
reference: ANT-2026-HMXB71C3.
Thanks,
Calif.io
View attachment "ANT-2026-HMXB71C3-report.md" of type "text/x-markdown" (3055 bytes)
Download attachment "ANT-2026-HMXB71C3.zip" of type "application/zip" (3290 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
