[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CADdoe43sq=ZfOQxH97aEsVPmg3ofqyWUxy0B8tw31F7h4ne2bg@mail.gmail.com>
Date: Mon, 26 Oct 2026 09:29:13 -0700
From: Thai Duong <thai@...if.io>
To: Rich Felker <dalias@...c.org>
Cc: musl@...ts.openwall.com
Subject: Re: [SECURITY] musl: out-of-bounds read in regexec()
backtracking (src/regex/regexec.c, 1.2.6)
Thanks and sorry for the noise.
On Mon, Oct 26, 2026 at 08:15 Rich Felker <dalias@...c.org> wrote:
> On Mon, Oct 26, 2026 at 05:35:06AM -0700, Thai Duong wrote:
> > Hello,
> >
> > Calif.io, working with Anthropic, is reporting a memory-safety issue
> > in musl's regex matcher. In tre_tnfa_run_backtrack()
> > (src/regex/regexec.c), the backtracking retry path rolls back the
> > match state but not pos_add_next, so after a retry GET_NEXT_WCHAR
> > advances the byte position by a stale length. On a subject that mixes
> > single-byte and multibyte characters the recorded byte offsets desync
> > and the final strncmp (regexec.c:785) reads past the end of the
> > subject buffer. It is reachable through the exported regexec() when
> > the application uses a backreference pattern and passes an
> > attacker-controlled subject string, which regexec is documented to
> > accept. It is present at v1.2.6 and master.
> >
> > The full write-up and a source-level reproduction are in the attached
> > report, and the proof of concept is attached as ANT-2026-HMXB71C3.zip
> > and also mirrored at
> > https://drive.google.com/file/d/1AUXONoLV-U5XDuOvLk9IbjEEiRR8cI1p/view.
> >
> > This issue was found by Claude and verified by Calif.io engineers. Our
> > reference: ANT-2026-HMXB71C3.
>
> If accurate this is a bug, but not a security one. The ability to
> provide attacker-controlled BREs is inherently a DoS vector through
> exponential-time matching. I'll check it out and see if we can get a
> fix in for the 1.2.7 release.
>
> Rich
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
