Bug 83754 - Segmentation fault in regex_search
Summary: Segmentation fault in regex_search
Status: NEW
Alias: None
Product: gcc
Classification: Unclassified
Component: libstdc++ (show other bugs)
Version: 7.2.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks: std::regex
  Show dependency treegraph
 
Reported: 2018-01-09 15:50 UTC by Antony Polukhin
Modified: 2021-09-22 08:32 UTC (History)
3 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2019-01-22 00:00:00


Attachments
test case using gcc compilation output (8.35 KB, application/gzip)
2018-08-23 15:00 UTC, Wendell Baker
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Antony Polukhin 2018-01-09 15:50:21 UTC
The following code 

#include <regex>
#include <string>

int main() {
  std::regex pattern("\\w+\\.");
  std::string s(1000000, 'a');
  return std::regex_search(s, pattern);
}


leads to segmentation fault. Backtrace reports the following:

#1  0x00000000004174a2 in std::_Function_handler<bool (char), std::__detail::_BracketMatcher<std::regex_traits<char>, false, false> >::_M_invoke(std::_Any_data const&, char&&) ()
#2  0x0000000000415544 in std::function<bool (char)>::operator()(char) const ()
#3  0x0000000000411222 in std::__detail::_State<char>::_M_matches(char) const ()
#4  0x000000000040cde3 in std::__detail::_Executor<skip>::_M_handle_match
<Following block is repeated thousands of times:>
#5  0x0000000000409cb0 in std::__detail::_Executor<skip>::_M_dfs
#6  0x0000000000411656 in std::__detail::_Executor<skip>::_M_rep_once_more
#7  0x000000000040ca05 in std::__detail::_Executor<skip>::_M_handle_repeat
<...>
#11350  0x0000000000409cb0 in std::__detail::_Executor<skip>::_M_dfs
#11351  0x0000000000411656 in std::__detail::_Executor<skip>::_M_rep_once_more
#11352  0x000000000040ca05 in std::__detail::_Executor<skip>::_M_handle_repeat
<...>


This issue could be related to the bug 79539
Comment 1 Tim Shen 2018-01-09 20:02:09 UTC
This is actually the same as bug 61601. The crash is due to stack overflow, because the implementation uses recursion.

If you set the stack limit to 100x higher (ulimit -s 819200 for me), it stops crashing and have the somewhat expected quadratic behavior.
Comment 2 Wendell Baker 2018-08-23 15:00:39 UTC
Created attachment 44582 [details]
test case using gcc compilation output

$ tar -avxf example.tar.gz 
libstdc++_std_regex_executor/
libstdc++_std_regex_executor/.gitignore
libstdc++_std_regex_executor/Makefile
libstdc++_std_regex_executor/exhibit_grep
libstdc++_std_regex_executor/exhibit_perl
libstdc++_std_regex_executor/exhibit_sed
libstdc++_std_regex_executor/main.cpp

$ cd libstdc++_std_regex_executor/

$ make check
g++ -c -o main.o -std=c++1z  main.cpp
g++ -o driver main.o  
./driver
make: *** [Makefile:14: check] Segmentation fault (core dumped)