regex() function crash.

manticore 3.5.4

select id, billNo, regex(billNo, '.*5675.*') as fuzzy from o where match('5675');  

/builds/manticoresearch/dev/cache/re2-src/re2/re2.cc:822: Invalid RE2: no argument for repetition operator: *  
  
/builds/manticoresearch/dev/cache/re2-src/re2/re2.cc:822: Invalid RE2: no argument for repetition operator: *  
  
/builds/manticoresearch/dev/cache/re2-src/re2/re2.cc:822: Invalid RE2: no argument for repetition operator: *  
  
/builds/manticoresearch/dev/cache/re2-src/re2/re2.cc:822: Invalid RE2: no argument for repetition operator: *  
  
/builds/manticoresearch/dev/cache/re2-src/re2/re2.cc:822: Invalid RE2: no argument for repetition operator: *  
  
free(): double free detected in tcache 2  
  
free(): double free detected in tcache 2  
  
caught SIGTERM, shutting down  
  
[Wed Jan 27 11:05:07.206 2021] [1] using config file '/etc/manticoresearch/manticore.conf' (316 chars)...  
  
starting daemon version '3.5.4 13f8d08d@201211 release' ...  
  
listening on all interfaces for sphinx and http(s), port=9312  
  
listening on all interfaces for sphinx and http(s), port=9308  
  
listening on all interfaces for mysql, port=9306  
  
Manticore 3.5.4 13f8d08d@201211 release  
  
Copyright (c) 2001-2016, Andrew Aksyonoff  
  
Copyright (c) 2008-2016, Sphinx Technologies Inc (http://sphinxsearch.com)  
  
Copyright (c) 2017-2020, Manticore Software LTD (http://manticoresearch.com)  
  
  
precaching index 'o'  
  
binlog: replaying log /var/lib/manticore/binlog.001  
  
binlog: index o: recovered from tid 119360 to tid 121368  
  
binlog: replay stats: 18072 rows in 2008 commits; 0 updates, 0 reconfigure; 0 pq-add; 0 pq-delete; 1 indexes  
  
binlog: finished replaying /var/lib/manticore/binlog.001; 19.0 MB in 3.988 sec  
  
binlog: finished replaying total 1 in 3.989 sec  
  
accepting connections  
  
prereading 1 indexes  
  
prereaded 1 indexes in 0.186 sec  
  
Crash!!! Handling signal 6  
  
free(): double free detected in tcache 2  
  
Crash!!! Handling signal 11  
  
[Wed Jan 27 11:10:18.587 2021] [1] using config file '/etc/manticoresearch/manticore.conf' (316 chars)...  
  
starting daemon version '3.5.4 13f8d08d@201211 release' ...  
  
listening on all interfaces for sphinx and http(s), port=9312  
  
listening on all interfaces for sphinx and http(s), port=9308  
  
listening on all interfaces for mysql, port=9306  
  
Manticore 3.5.4 13f8d08d@201211 release  
  
Copyright (c) 2001-2016, Andrew Aksyonoff  
  
Copyright (c) 2008-2016, Sphinx Technologies Inc (http://sphinxsearch.com)  
  
Copyright (c) 2017-2020, Manticore Software LTD (http://manticoresearch.com)  
  
  
precaching index 'o'  
  
binlog: replaying log /var/lib/manticore/binlog.001  
  
binlog: index o: recovered from tid 119360 to tid 121368  
  
binlog: replay stats: 18072 rows in 2008 commits; 0 updates, 0 reconfigure; 0 pq-add; 0 pq-delete; 1 indexes  
  
binlog: finished replaying /var/lib/manticore/binlog.001; 19.0 MB in 5.183 sec  
  
binlog: replaying log /var/lib/manticore/binlog.002  
  
binlog: replay stats: 0 rows in 0 commits; 0 updates, 0 reconfigure; 0 pq-add; 0 pq-delete; 0 indexes  
  
binlog: finished replaying /var/lib/manticore/binlog.002; 0.0 MB in 0.000 sec  
  
binlog: finished replaying total 2 in 5.183 sec  
  
accepting connections  
  
prereading 1 indexes  
  
prereaded 1 indexes in 0.317 sec  
  
free(): double free detected in tcache 2  
  
Crash!!! Handling signal 6  
  
free(): corrupted unsorted chunks  
  
Crash!!! Handling signal 11  
  
[Wed Jan 27 11:12:23.090 2021] [1] using config file '/etc/manticoresearch/manticore.conf' (316 chars)...  
  
starting daemon version '3.5.4 13f8d08d@201211 release' ...  
  
listening on all interfaces for sphinx and http(s), port=9312  
  
listening on all interfaces for sphinx and http(s), port=9308  
  
listening on all interfaces for mysql, port=9306  
  
Manticore 3.5.4 13f8d08d@201211 release  
  
Copyright (c) 2001-2016, Andrew Aksyonoff  
  
Copyright (c) 2008-2016, Sphinx Technologies Inc (http://sphinxsearch.com)  
  
Copyright (c) 2017-2020, Manticore Software LTD (http://manticoresearch.com)  
  
  
precaching index 'o'  
  
binlog: replaying log /var/lib/manticore/binlog.001  
  
binlog: index o: recovered from tid 119360 to tid 121368  
  
binlog: replay stats: 18072 rows in 2008 commits; 0 updates, 0 reconfigure; 0 pq-add; 0 pq-delete; 1 indexes  
  
binlog: finished replaying /var/lib/manticore/binlog.001; 19.0 MB in 6.630 sec  
  
binlog: replaying log /var/lib/manticore/binlog.002  
  
binlog: replay stats: 0 rows in 0 commits; 0 updates, 0 reconfigure; 0 pq-add; 0 pq-delete; 0 indexes  
  
binlog: finished replaying /var/lib/manticore/binlog.002; 0.0 MB in 0.000 sec  
  
binlog: replaying log /var/lib/manticore/binlog.003  
  
binlog: replay stats: 0 rows in 0 commits; 0 updates, 0 reconfigure; 0 pq-add; 0 pq-delete; 0 indexes  
  
binlog: finished replaying /var/lib/manticore/binlog.003; 0.0 MB in 0.000 sec  
  
binlog: finished replaying total 3 in 6.630 sec  
  
prereading 1 indexes  
  
accepting connections  
  
prereaded 1 indexes in 0.145 sec  
  
free(): double free detected in tcache 2  
  
Crash!!! Handling signal 6  
  
free(): double free detected in tcache 2  
  
Crash!!! Handling signal 11  

The report provides a reproducible SQL query using regex() and logs from Manticore 3.5.4; start by reproducing it and tracing regex() handling around the RE2 error. Done means the query no longer crashes the server or corrupts memory, with a regression test for the reported input.