From: "alanwu (Alan Wu) via ruby-core" <ruby-core@...>
Date: 2024-01-24T23:27:23+00:00
Subject: [ruby-core:116432] [Ruby master Bug#20207] Segmentation fault for a regexp containing positive and negative lookaheads

Issue #20207 has been updated by alanwu (Alan Wu).


I get a SEGV on darwin if I run it repeatedly. With Valgrind on Linux I get:

```
==216941== Invalid read of size 4
==216941==    at 0x4AA75B0: match_at (regexec.c:3894)
==216941==    by 0x4AB0D2C: onig_search_gpos (regexec.c:5361)
==216941==    by 0x4AB1209: onig_search (regexec.c:5090)
==216941==    by 0x4A8D811: reg_onig_search (re.c:1725)
==216941==    by 0x4A922B2: rb_reg_onig_match (re.c:1661)
==216941==    by 0x4A949EA: rb_reg_match_p (re.c:3821)
```

Which points to the following:

```
    CASE(OP_POP_POS)  MOP_IN(OP_POP_POS);
      {
	STACK_POS_END(stkp);
	s     = stkp->u.state.pstr;
	sprev = stkp->u.state.pstr_prev;
      }
      MOP_OUT;
>>>   JUMP;
```

----------------------------------------
Bug #20207: Segmentation fault for a regexp containing positive and negative lookaheads
https://bugs.ruby-lang.org/issues/20207#change-106454

* Author: Sundeep (Sundeep Agarwal)
* Status: Open
* Priority: Normal
* Assignee: make_now_just (Hiroya Fujinami)
* Backport: 3.0: DONTNEED, 3.1: DONTNEED, 3.2: DONTNEED, 3.3: REQUIRED
----------------------------------------
I'm getting segmentation fault for the following regexp with Ruby 3.3.0:

``` ruby
puts 'clan'.match?(/(?=.*a)(?!.*n)/)
```

This is the minimal example for which I was able to produce the issue. `a` and `n` in the above example
are just a sample, can be other character combinations too. There has to be at least two characters
before them in the input string (`cl` in the above example).

The error is seen when the above code is run from a file, but only occasionally from irb.
When run from a file, most of the time I get segmentation fault (see attached log file),
but sometimes I get the following error:

``` ruby
lookaround.rb:1:in `match?': undefined bytecode (bug): /(?=.*a)(?!.*n)/ (RegexpError)
	from lookaround.rb:1:in `<main>'
```

When asked in the r/ruby forum, somebody else was able to reproduce this issue.
They also mentioned that the issue wasn't seen in the Ruby 3.2.2 version.

---Files--------------------------------
lookaround_segfault.log (15.9 KB)


-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/