Fix out-of-bounds access in regexp inclusion test (#3242)
authorAndres Noetzli <andres.noetzli@gmail.com>
Fri, 30 Aug 2019 16:14:28 +0000 (09:14 -0700)
committerGitHub <noreply@github.com>
Fri, 30 Aug 2019 16:14:28 +0000 (09:14 -0700)
commitf727de338f15a02e07d2a79cf94940a9786e0864
tree5782fe9ec89e928e0bead1d481b05bff43ef0640
parent375731ea23fa7d139f1b0bdf6bed24d83c152e67
Fix out-of-bounds access in regexp inclusion test (#3242)

If `re.*(re.allchar)` was at the end of a regular expression
concatenation, the regular expression inclusion test could cause
out-of-bound accesses. For `re.*(re.allchar)`, we were blindly adding
the index after it to the set of indices being considered. Later in the
loop, we were assuming that all the indices are smaller than the number
of components in the concatenation, thus leading to out-of-bound
accesses. This commit adds a check before adding the index to the set of
indices.

Signed-off-by: Andres Noetzli <andres.noetzli@gmail.com>
src/theory/strings/regexp_operation.cpp