head	1.1;
access;
symbols;
locks; strict;
comment	@# @;


1.1
date	2026.09.06.18.44.01;	author bsiegert;	state Exp;
branches;
next	;
commitid	TNp9CVbeVgbBMAUG;


desc
@@


1.1
log
@augeas: install lenses, fix CVE-2025-2588

Make augeas install all the lenses so it is actually usable. Also fix a
security issue which is not in a release yet.

From Showta Ishizaki in PR pkg/60656.
@
text
@$NetBSD$

Fix a NULL dereference in the regexp parser.  CVE-2025-2588.

parse_regexp() could return NULL while leaving parse->error at REG_NOERROR.
fa_expand_nocase(), fa_restrict_alphabet() and fa_expand_char_ranges() only
test parse->error before dereferencing what came back, so they walk into the
NULL and the process dies.  Upstream fixed this at the error label rather
than adding a check to each of the three callers.

Upstream commit af2aa88ab37fc48167d8c5e43b1770a4ba2ff403 applied verbatim:
the fix itself, the fa.h comment that documents the new return value, and
the regression test.  It has not been released; 1.14.1 (2023) is still the
last release.

_REG_ENOSYS is not in NetBSD's <regex.h>, but augeas is built with
-I ../gnulib/lib and takes <regex.h> from the bundled gnulib copy, which
defines it.  Without the src/fa.c hunk below, tests/fatest dies with SIGSEGV.

https://github.com/hercules-team/augeas/issues/852

--- src/fa.c.orig
+++ src/fa.c
@@@@ -3550,6 +3550,8 @@@@
     return re;
 
  error:
+    if (re == NULL && parse->error == REG_NOERROR)
+        parse->error = _REG_ENOSYS;
     re_unref(re);
     return NULL;
 }

--- src/fa.h.orig
+++ src/fa.h
@@@@ -81,7 +81,8 @@@@
  *
  * On success, FA points to the newly allocated automaton constructed for
  * RE, and the function returns REG_NOERROR. Otherwise, FA is NULL, and the
- * return value indicates the error.
+ * return value indicates the error. Special value _REG_ENOSYS indicates
+ * fa_compile() couldn't identify the syntax issue with regexp.
  *
  * The FA is case sensitive. Call FA_NOCASE to switch it to
  * case-insensitive.

--- tests/fatest.c.orig
+++ tests/fatest.c
@@@@ -589,6 +589,7 @@@@
     const char *p1 = "aB";
     const char *p2 = "[a-cUV]";
     const char *p3 = "[^a-z]";
+    const char *wrong_regexp = "{&.{";
     char *s;
     size_t len;
     int r;
@@@@ -607,6 +608,11 @@@@
     CuAssertIntEquals(tc, 0, r);
     CuAssertStrEquals(tc, "[^A-Za-z]", s);
     free(s);
+
+    /* Test that fa_expand_nocase does return _REG_ENOSYS */
+    r = fa_expand_nocase(wrong_regexp, strlen(wrong_regexp), &s, &len);
+    CuAssertIntEquals(tc, _REG_ENOSYS, r);
+    free(s);
 }
 
 static void testNoCaseComplement(CuTest *tc) {
@