two (and a half) more crashes in regex module

[Assaf Gordon]

Hello,

Prompted by the recent bug reports, I decided to do some
targeted fuzzing on gnulib's regex module using afl.

So far I found two obscure bugs, and one pathological case.

Can be easily reproduced with:

   $ echo 1 |  grep -E "(\'|^)(\1|)"
   grep: regexec.c:1375: pop_fail_stack: Assertion `num >= 0' failed.
   Aborted

   $ echo A | grep -E "$(printf '(\227|)(\\1\\1|t1|\\\2537)+')"
   Segmentation fault  ## stack overflow due to infinite recursion

And the following pathological case can easily consume hundreds of MB of 
RAM (more "+" - more RAM):

   $ echo 1 | time grep -E '(.)++++++++++++++++++++++|'


Attached are valgrind/gdb details of each crash,
and also a C reproducer (if it's easier to debug with a tiny
C program instead of grep).

(As usual, I don't have a fix yet...)



regards,
  - assaf

crash1.valgrind.log
Description: Text document

crash2.valgrind.log
Description: Text document

1.c
Description: Text Data

crash2.gdb.log.gz
Description: application/gzip