sed: fix substitution of empty capturing groups.

The test for \N where N was larger than the number of capturing groups
in the regular expression was incorrect, and firing for cases such as
matching __(ARM_)?NR_([a-z]*) against __NR_read, where the first group is
empty (because it failed to match) but the second group did match "read".

Use regex_t's re_nsub for the error check, and treat rm_so == -1 as a
signal to just copy nothing into the result.

(Found trying to build minijail in AOSP.)

1 files changed, 11 insertions, 0 deletions

diff --git a/tests/sed.test b/tests/sed.test
index f2ff8fd7..34dfa161 100755
--- a/tests/sed.test
+++ b/tests/sed.test
@@ -72,6 +72,8 @@ testing "aci" \
 	"sed -e '3a boom' -e '/hre/i bang' -e '3a whack' -e '3c bong'" \
 	"one\ntwo\nbang\nbong\nboom\nwhack\nfour\n" "" \
 	"one\ntwo\nthree\nfour\n"
+# TODO: next test is broken on new-ish debian/bash with never-ending
+# output of `sed: short write: Broken pipe`.
 testing "b loop" "sed ':woo;=;b woo' | head -n 5" '1\n1\n1\n1\n1\n' "" "X"
 testing "b skip" "sed -n '2b zap;d;:zap;p'" "two\n" "" "one\ntwo\nthree"
 testing "b end" "sed -n '2b;p'" "one\nthree" "" "one\ntwo\nthree"
@@ -167,4 +169,13 @@ testing "end b with }" "sed -n '/START/{:a;n;/END/q;p;ba}'" "b\nc\n" \
 
 testing '-z' 'sed -z "s/\n/-/g"' "a-b-c" "" "a\nb\nc"
 
+# toybox handling of empty capturing groups broke minjail. Check that we
+# correctly replace an empty capturing group with the empty string:
+testing '\n with empty capture' \
+    'sed -E "s/(ARM_)?(NR_)([a-z]*) (.*)/\1\2\3/"' "NR_read" "" "NR_read foo"
+# ...but also that we report an error for a backreference to a group that
+# isn't in the pattern:
+testing '\n too high' \
+    'sed -E "s/(.*)/\2/p" 2>/dev/null || echo OK' "OK\n" "" "foo"
+
 # -i with $ last line test