Fixes: debbugs:17865

[bpt/emacs.git] / src / regex.c

diff --git a/src/regex.c b/src/regex.c
index faa645c..2449240 100644 (file)
--- a/src/regex.c
+++ b/src/regex.c
@@ -2,7 +2,7 @@
    0.12.  (Implements POSIX draft P1003.2/D11.2, except for some of the
    internationalization features.)
 
-   Copyright (C) 1993-2013 Free Software Foundation, Inc.
+   Copyright (C) 1993-2014 Free Software Foundation, Inc.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -3311,15 +3311,15 @@ regex_compile (const_re_char *pattern, size_t size, reg_syntax_t syntax,
                GET_INTERVAL_COUNT (lower_bound);
 
                if (c == ',')
-                 {
-                   GET_INTERVAL_COUNT (upper_bound);
-                   if (upper_bound < lower_bound)
-                     FREE_STACK_RETURN (REG_BADBR);
-                 }
+                 GET_INTERVAL_COUNT (upper_bound);
                else
                  /* Interval such as `{1}' => match exactly once. */
                  upper_bound = lower_bound;
 
+               if (lower_bound < 0
+                   || (0 <= upper_bound && upper_bound < lower_bound))
+                 FREE_STACK_RETURN (REG_BADBR);
+
                if (!(syntax & RE_NO_BK_BRACES))
                  {
                    if (c != '\\')