RootCauseunvalidated
regarray->start = XCALLOC(1, regoff_t) // Only allocates 1 element! — In regexp.c lines 265-267 within match_regex. Tension: regsize can reach 16 (when max_id is 15). Outcome: Later code at lines 273-274 attempts to write to regarray->start[i] for i >= 1, causing overflow.
929ff736-247b-4553-acd9-44771e3e92b5
regarray->start = XCALLOC(1, regoff_t) // Only allocates 1 element! — In regexp.c lines 265-267 within match_regex. Tension: regsize can reach 16 (when max_id is 15). Outcome: Later code at lines 273-274 attempts to write to regarray->start[i] for i >= 1, causing overflow.