git: contrib/tre: Fix a use-after-free bug and a memory leak bug

[Aaron LI]

commit c8eb5f6df313a374bce3c4729db2dd51b2685bcc
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Oct 20 17:37:41 2026 +0800

    contrib/tre: Fix a use-after-free bug and a memory leak bug
    
    The 'tags', 'pmatch' and 'states_seen' are interior pointers into a
    single 'buf' allocation, so calling xfree() on each of them was a
    use-after-free bug.
    
    While there, there was another memory leak bug in handling 'buf'
    allocation failure, where the previously allocated 'mem' was not freed
    before return.
    
    Fix both bugs by using 'goto error_exit' for proper memory free.
    
    The use-after-free bug was caught by the '-Wuse-after-free' warnings
    from GCC 12.5, e.g.,
    ```
    In file included from /usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c:78:
    /usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c: In function 'tre_tnfa_run_backtrack':
    /usr/src/lib/libc/../../contrib/tre/lib/xmalloc.h:69:20: warning: pointer 'tmp_buf' used after 'free' [-Wuse-after-free]
       69 | #define xfree(ptr) free(ptr)
          |                    ^~~~~~~~~
    /usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c:143:17: note: in expansion of macro 'xfree'
      143 |                 xfree(pmatch);                                                \
          |                 ^~~~~
    /usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c:351:11: note: in expansion of macro 'BT_STACK_PUSH'
      351 |           BT_STACK_PUSH(pos, pos_add_next, str_byte, str_wide, trans_i->state,
          |           ^~~~~~~~~~~~~
    /usr/src/lib/libc/../../contrib/tre/lib/xmalloc.h:69:20: note: call to 'free' here
       69 | #define xfree(ptr) free(ptr)
          |                    ^~~~~~~~~
    /usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c:141:17: note: in expansion of macro 'xfree'
      141 |                 xfree(tags);                                                  \
          |                 ^~~~~
    /usr/src/lib/libc/../../contrib/tre/lib/tre-match-backtrack.c:351:11: note: in expansion of macro 'BT_STACK_PUSH'
      351 |           BT_STACK_PUSH(pos, pos_add_next, str_byte, str_wide, trans_i->state,
          |           ^~~~~~~~~~~~~
    ```
    
    Assisted-by: DeepSeek-v4.1-flash (with Pi Coding Agent)

Summary of changes:
 contrib/tre/README.DRAGONFLY          |  3 +++
 contrib/tre/lib/tre-match-backtrack.c | 25 ++++++++-----------------
 2 files changed, 11 insertions(+), 17 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/c8eb5f6df313a374bce3c4729db2dd51b2685bcc


-- 
DragonFly BSD source repository