You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by jo...@apache.org on 2026/09/24 14:48:19 UTC

svn commit: r1938489 - httpd/httpd/trunk/modules/filters

Author: jorton
Date: Thu Sep 24 14:48:19 2026
New Revision: 1938489

Log:
* modules/filters/regexp.c (_advance): Treat a starred backreference to
  a capture which matched nothing as matching once; both loops step the
  input pointer by the capture length and so never terminate.

Co-Authored-By: Claude Opus 5 (1M context) <no...@anthropic.com>
GitHub: PR #769

Modified:
   httpd/httpd/trunk/modules/filters/regexp.c

Modified: httpd/httpd/trunk/modules/filters/regexp.c
==============================================================================
--- httpd/httpd/trunk/modules/filters/regexp.c	Thu Sep 24 14:48:07 2026	(r1938488)
+++ httpd/httpd/trunk/modules/filters/regexp.c	Thu Sep 24 14:48:19 2026	(r1938489)
@@ -535,6 +535,13 @@ static int _advance(char *lp, char *ep,
             bbeg = vars->braslist[epint];
             ct = vars->braelist[epint] - bbeg;
             ep++;
+            if (ct == 0) {
+                /* The capture matched nothing, so repeating it consumes
+                 * nothing: it can only match once, here.  Both loops below
+                 * step lp by ct and would never make progress.
+                 */
+                continue;
+            }
             curlp = lp;
             while (ecmp(bbeg, lp, ct))
                 lp += ct;