From b6faad1a1d1550a09bf6ab1f65d45e3ffee10663 Mon Sep 17 00:00:00 2001
From: millert <millert@openbsd.org>
Date: Mon, 28 Dec 2020 21:41:55 +0000
Subject: Fix an off-by-one error in the marking of the O_CH operator following
 an OOR2 operator.  Also includes a regress test for the issue. From FreeBSD
 via miod@

---
 lib/libc/regex/engine.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'lib/libc/regex/engine.c')

diff --git a/lib/libc/regex/engine.c b/lib/libc/regex/engine.c
index 9d3ca24a800..62da73f99fe 100644
--- a/lib/libc/regex/engine.c
+++ b/lib/libc/regex/engine.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: engine.c,v 1.25 2018/07/11 12:38:46 martijn Exp $	*/
+/*	$OpenBSD: engine.c,v 1.26 2020/12/28 21:41:55 millert Exp $	*/
 
 /*-
  * Copyright (c) 1992, 1993, 1994 Henry Spencer.
@@ -935,7 +935,7 @@ step(struct re_guts *g,
 				    OP(s = g->strip[pc+look]) != O_CH;
 				    look += OPND(s))
 					assert(OP(s) == OOR2);
-				FWD(aft, aft, look);
+				FWD(aft, aft, look + 1);
 			}
 			break;
 		case OOR2:		/* propagate OCH_'s marking */
-- 
cgit v1.2.3-59-g8ed1b