From 6ce53562bde98cec1a0595b9a21403298c8ad99d Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Mon, 24 Mar 2025 09:48:19 +0200
Subject: [PATCH] CVE-2025-2588: return _REG_ENOSYS if no specific error was
 set yet parse_regexp failed

parse_regexp() supposed to set an error on the parser state in case of a
failure. If no specific error was set, return _REG_ENOSYS to indicate a
generic failure.

Fixes: https://github.com/hercules-team/augeas/issues/671
Fixes: https://github.com/hercules-team/augeas/issues/778
Fixes: https://github.com/hercules-team/augeas/issues/852

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
 src/fa.c       | 2 ++
 src/fa.h       | 3 ++-
 tests/fatest.c | 6 ++++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/fa.c b/src/fa.c
index 66ac70784..4de5675b9 100644
--- a/src/fa.c
+++ b/src/fa.c
@@ -3550,6 +3550,8 @@ static struct re *parse_regexp(struct re_parse *parse) {
     return re;
 
  error:
+    if (re == NULL && parse->error == REG_NOERROR)
+        parse->error = _REG_ENOSYS;
     re_unref(re);
     return NULL;
 }
diff --git a/src/fa.h b/src/fa.h
index 1fd754ad0..89c9b17e9 100644
--- a/src/fa.h
+++ b/src/fa.h
@@ -81,7 +81,8 @@ extern int fa_minimization_algorithm;
  *
  * On success, FA points to the newly allocated automaton constructed for
  * RE, and the function returns REG_NOERROR. Otherwise, FA is NULL, and the
- * return value indicates the error.
+ * return value indicates the error. Special value _REG_ENOSYS indicates
+ * fa_compile() couldn't identify the syntax issue with regexp.
  *
  * The FA is case sensitive. Call FA_NOCASE to switch it to
  * case-insensitive.
diff --git a/tests/fatest.c b/tests/fatest.c
index 0c9ca7696..6717af8f4 100644
--- a/tests/fatest.c
+++ b/tests/fatest.c
@@ -589,6 +589,7 @@ static void testExpandNoCase(CuTest *tc) {
     const char *p1 = "aB";
     const char *p2 = "[a-cUV]";
     const char *p3 = "[^a-z]";
+    const char *wrong_regexp = "{&.{";
     char *s;
     size_t len;
     int r;
@@ -607,6 +608,11 @@ static void testExpandNoCase(CuTest *tc) {
     CuAssertIntEquals(tc, 0, r);
     CuAssertStrEquals(tc, "[^A-Za-z]", s);
     free(s);
+
+    /* Test that fa_expand_nocase does return _REG_ENOSYS */
+    r = fa_expand_nocase(wrong_regexp, strlen(wrong_regexp), &s, &len);
+    CuAssertIntEquals(tc, _REG_ENOSYS, r);
+    free(s);
 }
 
 static void testNoCaseComplement(CuTest *tc) {