(EXTEND_BUFFER): Change order of pointer addition operations, to avoid

having the difference between pointers overflow.

1 files changed, 7 insertions, 5 deletions

diff --git a/src/regex.c b/src/regex.c
index 6435133c96f..e793df3da81 100644
--- a/src/regex.c
+++ b/src/regex.c
@@ -1832,8 +1832,10 @@ static int analyse_first _RE_ARGS ((re_char *p, re_char *pend,
    being larger than MAX_BUF_SIZE, then flag memory exhausted.  */
 #if __BOUNDED_POINTERS__
 # define SET_HIGH_BOUND(P) (__ptrhigh (P) = __ptrlow (P) + bufp->allocated)
-# define MOVE_BUFFER_POINTER(P) \
-  (__ptrlow (P) += incr, SET_HIGH_BOUND (P), __ptrvalue (P) += incr)
+# define MOVE_BUFFER_POINTER(P)                                 \
+  (__ptrlow (P) = new_buffer + (__ptrlow (P) - old_buffer),     \
+   SET_HIGH_BOUND (P),                                          \
+   __ptrvalue (P) = new_buffer + (__ptrvalue (P) - old_buffer))
 # define ELSE_EXTEND_BUFFER_HIGH_BOUND          \
   else                                          \
     {                                           \
@@ -1847,12 +1849,12 @@ static int analyse_first _RE_ARGS ((re_char *p, re_char *pend,
         SET_HIGH_BOUND (pending_exact);         \
     }
 #else
-# define MOVE_BUFFER_POINTER(P) (P) += incr
+# define MOVE_BUFFER_POINTER(P) ((P) = new_buffer + ((P) - old_buffer))
 # define ELSE_EXTEND_BUFFER_HIGH_BOUND
 #endif
 #define EXTEND_BUFFER()                                                 \
   do {                                                                  \
-    re_char *old_buffer = bufp->buffer;                                 \
+    unsigned char *old_buffer = bufp->buffer;                                   \
     if (bufp->allocated == MAX_BUF_SIZE)                                \
       return REG_ESIZE;                                                 \
     bufp->allocated <<= 1;                                              \
@@ -1864,7 +1866,7 @@ static int analyse_first _RE_ARGS ((re_char *p, re_char *pend,
     /* If the buffer moved, move all the pointers into it.  */          \
     if (old_buffer != bufp->buffer)                                     \
       {                                                                 \
-        int incr = bufp->buffer - old_buffer;                           \
+        unsigned char *new_buffer = bufp->buffer;                       \
         MOVE_BUFFER_POINTER (b);                                        \
         MOVE_BUFFER_POINTER (begalt);                                   \
         if (fixup_alt_jump)                                             \