Bug#441355: regcomp DoS'able in utf-8 locales

[Rich Felker <dalias@aerifal.cx>]

Package: libc6
Version: 2.6.1-2
Severity: important

glibc's regular expression engine crashes with sig11 whenever trying
to compile a regular expression with non-ASCII range expressions if
LC_CTYPE is a UTF-8 locale but LC_COLLATE is set to C or POSIX. This
is a common setup among users who want traditional codepoint-order
sorting but need UTF-8 encoding.

$ LANG=en_US.UTF-8 LC_COLLATE=C grep '[Á-ä]'
Segmentation fault

The bug can cause crashes in any program using the system regex
routines and could in principle be used for DoS attacks if a
less-privileged user is able to provide regular expressions to a
more-privileged process.