This patch originates from the Debian project, see https://www.debian.org/ 14private_regex_fixes.dpatch by Fixes to the private regex library; includes fix for #523934. diff -Naur regex.orig/regcomp.c regex/regcomp.c --- nvi-1.81.6.orig/regex/regcomp.c 2007-11-18 17:41:42.000000000 +0100 +++ nvi-1.81.6/regex/regcomp.c 2008-05-01 18:37:57.000000000 +0200 @@ -606,7 +606,8 @@ REQUIRE(starordinary, REG_BADRPT); /* FALLTHROUGH */ default: - ordinary(p, c &~ BACKSL); + /* ordinary(p, c &~ BACKSL); -- Fix potential overflow */ + ordinary(p, c & 0xff); break; } diff -Naur regex.orig/regexec.c regex/regexec.c --- nvi-1.81.6.orig/regex/regexec.c 2007-11-18 17:41:42.000000000 +0100 +++ nvi-1.81.6/regex/regexec.c 2008-05-01 18:38:00.000000000 +0200 @@ -63,7 +63,7 @@ /* macros for manipulating states, small version */ #define states int -#define states1 states /* for later use in regexec() decision */ +typedef states states1; /* for later use in regexec() decision */ #define CLEAR(v) ((v) = 0) #define SET0(v, n) ((v) &= ~(1 << (n))) #define SET1(v, n) ((v) |= 1 << (n))