* regcomp.c (compile_length_tree): return error code immediately

  if compile_length_tree raised error [Bug #12418]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55154 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 15 insertions, 5 deletions

diff --git a/ChangeLog b/ChangeLog
index d017319a41..883216c771 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Wed May 25 13:10:30 2016  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* regcomp.c (compile_length_tree): return error code immediately
+	  if compile_length_tree raised error [Bug #12418]
+
 Wed May 25 08:01:39 2016  Martin Duerst  <duerst@it.aoyama.ac.jp>
 
 	* enc/unicode.c: Fix flag error for switch from titlecase to lowercase.
diff --git a/regcomp.c b/regcomp.c
index 23cb0ead9a..34b37f8e4c 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -1592,13 +1592,15 @@ compile_length_tree(Node* node, regex_t* reg)
 
   case NT_ALT:
     {
-      int n;
-
-      n = r = 0;
+      int n = 0;
+      len = 0;
       do {
-	r += compile_length_tree(NCAR(node), reg);
-	n++;
+        r = compile_length_tree(NCAR(node), reg);
+        if (r < 0) return r;
+        len += r;
+        n++;
       } while (IS_NOT_NULL(node = NCDR(node)));
+      r = len;
       r += (SIZE_OP_PUSH + SIZE_OP_JUMP) * (n - 1);
     }
     break;
diff --git a/test/ruby/test_regexp.rb b/test/ruby/test_regexp.rb
index 34466e0262..85e78383b0 100644
--- a/test/ruby/test_regexp.rb
+++ b/test/ruby/test_regexp.rb
@@ -1078,6 +1078,9 @@ class TestRegexp < Test::Unit::TestCase
     conds = {"xy"=>true, "yx"=>true, "xx"=>false, "yy"=>false}
     assert_match_each(/\A((x)|(y))(?(2)y|x)\z/, conds, bug8583)
     assert_match_each(/\A((?<x>x)|(?<y>y))(?(<x>)y|x)\z/, conds, bug8583)
+
+    bug12418 = '[ruby-core:75694] [Bug #12418]'
+    assert_raise(RegexpError, bug12418){ Regexp.new('(0?0|(?(5)||)|(?(5)||))?') }
   end
 
   def test_options_in_look_behind