Avoid double-free in regexec after stack_double

jhawthorn · XrXr · commit 8628db12cb58 · 2024-11-08T10:41:41.000-05:00
diff --git a/regexec.c b/regexec.c
@@ -4217,9 +4217,8 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
   return ONIGERR_UNEXPECTED_BYTECODE;
 
  timeout:
+  STACK_SAVE;
   xfree(xmalloc_base);
-  if (stk_base != stk_alloc || IS_NOT_NULL(msa->stack_p))
-      xfree(stk_base);
   return ONIGERR_TIMEOUT;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -4217,9 +4217,8 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,`
`4217`	`4217`	`return ONIGERR_UNEXPECTED_BYTECODE;`
`4218`	`4218`
`4219`	`4219`	`timeout:`
	`4220`	`+ STACK_SAVE;`
`4220`	`4221`	`xfree(xmalloc_base);`
`4221`		`- if (stk_base != stk_alloc \|\| IS_NOT_NULL(msa->stack_p))`
`4222`		`- xfree(stk_base);`
`4223`	`4222`	`return ONIGERR_TIMEOUT;`
`4224`	`4223`	`}`
`4225`	`4224`