Use after free when parsing "(|"

[hannob]

The current develop branch has a use after free bug when parsing the regexp "(|". Here's some example code to trigger this:

#include <oniguruma.h>
int main() {
    regex_t *reg;
    const OnigUChar * inp = (const OnigUChar * )"(|";
    if (onig_new
        (&reg, inp, inp+2, ONIG_OPTION_DEFAULT, ONIG_ENCODING_UTF8,
         ONIG_SYNTAX_DEFAULT, 0) == 0)
        onig_free(reg);
    return 0;
}

I suspect that this got introduced when fixing issue #26.

Here's the stack trace from address sanitizer:

==3544==ERROR: AddressSanitizer: heap-use-after-free on address 0x60600000eea0 at pc 0x0000004f4365 bp 0x7ffd635e32f0 sp 0x7ffd635e32e8
READ of size 4 at 0x60600000eea0 thread T0
    #0 0x4f4364 in onig_node_free /mnt/ram/x/oniguruma1/src/regparse.c:1020:11
    #1 0x4f4314 in onig_node_free /mnt/ram/x/oniguruma1/src/regparse.c:1030:5
    #2 0x508bf1 in parse_enclose /mnt/ram/x/oniguruma1/src/regparse.c:4664:5
    #3 0x508bf1 in parse_exp /mnt/ram/x/oniguruma1/src/regparse.c:4915
    #4 0x502fcf in parse_branch /mnt/ram/x/oniguruma1/src/regparse.c:5241:7
    #5 0x50021d in parse_subexp /mnt/ram/x/oniguruma1/src/regparse.c:5284:7
    #6 0x4f6f78 in parse_regexp /mnt/ram/x/oniguruma1/src/regparse.c:5331:7
    #7 0x4f6f78 in onig_parse_make_tree /mnt/ram/x/oniguruma1/src/regparse.c:5362
    #8 0x51ed42 in onig_compile /mnt/ram/x/oniguruma1/src/regcomp.c:5283:7
    #9 0x544ac8 in onig_new /mnt/ram/x/oniguruma1/src/regcomp.c:5522:7
    #10 0x4f2320 in main /mnt/ram/x/oniguruma1/onig-useafterfree-onig_node_free.c:8:6
    #11 0x7f2b6da246ff in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.23-r2/work/glibc-2.23/csu/../csu/libc-start.c:289
    #12 0x4198f8 in _start (/mnt/ram/x/oniguruma1/a.out+0x4198f8)

0x60600000eea0 is located 0 bytes inside of 56-byte region [0x60600000eea0,0x60600000eed8)
freed by thread T0 here:
    #0 0x4c1510 in __interceptor_free (/mnt/ram/x/oniguruma1/a.out+0x4c1510)
    #1 0x4f4712 in onig_node_free /mnt/ram/x/oniguruma1/src/regparse.c:1071:3
    #2 0x508ab6 in parse_enclose /mnt/ram/x/oniguruma1/src/regparse.c:4662:7
    #3 0x508ab6 in parse_exp /mnt/ram/x/oniguruma1/src/regparse.c:4915
    #4 0x502fcf in parse_branch /mnt/ram/x/oniguruma1/src/regparse.c:5241:7
    #5 0x50021d in parse_subexp /mnt/ram/x/oniguruma1/src/regparse.c:5284:7
    #6 0x4f6f78 in parse_regexp /mnt/ram/x/oniguruma1/src/regparse.c:5331:7
    #7 0x4f6f78 in onig_parse_make_tree /mnt/ram/x/oniguruma1/src/regparse.c:5362
    #8 0x51ed42 in onig_compile /mnt/ram/x/oniguruma1/src/regcomp.c:5283:7
    #9 0x544ac8 in onig_new /mnt/ram/x/oniguruma1/src/regcomp.c:5522:7
    #10 0x0  (<unknown module>)

previously allocated by thread T0 here:
    #0 0x4c1818 in __interceptor_malloc (/mnt/ram/x/oniguruma1/a.out+0x4c1818)
    #1 0x503823 in node_new /mnt/ram/x/oniguruma1/src/regparse.c:1079:18
    #2 0x503823 in node_new_str /mnt/ram/x/oniguruma1/src/regparse.c:1410
    #3 0x503823 in node_new_empty /mnt/ram/x/oniguruma1/src/regparse.c:1442
    #4 0x503823 in parse_exp /mnt/ram/x/oniguruma1/src/regparse.c:4910
    #5 0x502fcf in parse_branch /mnt/ram/x/oniguruma1/src/regparse.c:5241:7
    #6 0x5004b5 in parse_subexp /mnt/ram/x/oniguruma1/src/regparse.c:5299:11
    #7 0x508ab6 in parse_enclose /mnt/ram/x/oniguruma1/src/regparse.c:4662:7
    #8 0x508ab6 in parse_exp /mnt/ram/x/oniguruma1/src/regparse.c:4915
    #9 0x502fcf in parse_branch /mnt/ram/x/oniguruma1/src/regparse.c:5241:7
    #10 0x50021d in parse_subexp /mnt/ram/x/oniguruma1/src/regparse.c:5284:7
    #11 0x4f6f78 in parse_regexp /mnt/ram/x/oniguruma1/src/regparse.c:5331:7
    #12 0x4f6f78 in onig_parse_make_tree /mnt/ram/x/oniguruma1/src/regparse.c:5362
    #13 0x51ed42 in onig_compile /mnt/ram/x/oniguruma1/src/regcomp.c:5283:7
    #14 0x544ac8 in onig_new /mnt/ram/x/oniguruma1/src/regcomp.c:5522:7
    #15 0x0  (<unknown module>)

SUMMARY: AddressSanitizer: heap-use-after-free /mnt/ram/x/oniguruma1/src/regparse.c:1020:11 in onig_node_free
Shadow bytes around the buggy address:
  0x0c0c7fff9d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff9dc0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 fa
=>0x0c0c7fff9dd0: fa fa fa fa[fd]fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fff9de0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fff9df0: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa
  0x0c0c7fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

[kkos]

Thank you.
I have fixed it in develop branch.