[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20261026212950.GH23438@brightrain.aerifal.cx>
Date: Mon, 26 Oct 2026 17:29:50 -0400
From: Rich Felker <dalias@...c.org>
To: Thai Duong <thai@...if.io>
Cc: musl@...ts.openwall.com
Subject: Re: [SECURITY] musl: out-of-bounds read in regexec()
backtracking (src/regex/regexec.c, 1.2.6)
On Mon, Oct 26, 2026 at 09:29:13AM -0700, Thai Duong wrote:
> Thanks and sorry for the noise.
It's not noise, a good bug to get fixed. Just not one that calls for
disclosure plans and urgent fix.
Rich
> On Mon, Oct 26, 2026 at 08:15 Rich Felker <dalias@...c.org> wrote:
>
> > On Mon, Oct 26, 2026 at 05:35:06AM -0700, Thai Duong wrote:
> > > Hello,
> > >
> > > Calif.io, working with Anthropic, is reporting a memory-safety issue
> > > in musl's regex matcher. In tre_tnfa_run_backtrack()
> > > (src/regex/regexec.c), the backtracking retry path rolls back the
> > > match state but not pos_add_next, so after a retry GET_NEXT_WCHAR
> > > advances the byte position by a stale length. On a subject that mixes
> > > single-byte and multibyte characters the recorded byte offsets desync
> > > and the final strncmp (regexec.c:785) reads past the end of the
> > > subject buffer. It is reachable through the exported regexec() when
> > > the application uses a backreference pattern and passes an
> > > attacker-controlled subject string, which regexec is documented to
> > > accept. It is present at v1.2.6 and master.
> > >
> > > The full write-up and a source-level reproduction are in the attached
> > > report, and the proof of concept is attached as ANT-2026-HMXB71C3.zip
> > > and also mirrored at
> > > https://drive.google.com/file/d/1AUXONoLV-U5XDuOvLk9IbjEEiRR8cI1p/view.
> > >
> > > This issue was found by Claude and verified by Calif.io engineers. Our
> > > reference: ANT-2026-HMXB71C3.
> >
> > If accurate this is a bug, but not a security one. The ability to
> > provide attacker-controlled BREs is inherently a DoS vector through
> > exponential-time matching. I'll check it out and see if we can get a
> > fix in for the 1.2.7 release.
> >
> > Rich
> >
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
