<regex>: Make capture groups in negative lookahead assertions always match nothing (#5366)

muellerj2 · alexprabhatbara · StephanTLavavej · web-flow · commit 6791615cde83 · 2025-04-09T21:01:37.000-07:00
Co-authored-by: alexprabhatbara &lt;alex.prabhat@idrive.com&gt;
Co-authored-by: Stephan T. Lavavej &lt;stl@microsoft.com&gt;
diff --git a/stl/inc/regex b/stl/inc/regex
@@ -1670,6 +1670,8 @@ private:
     _Tgt_state_t<_It> _Res;
     vector<_Loop_vals_t> _Loop_vals;
 
+    bool _Do_assert(_Node_assert*);
+    bool _Do_neg_assert(_Node_assert*);
     bool _Do_if(_Node_if*);
     bool _Do_rep0(_Node_rep*, bool);
     bool _Do_rep(_Node_rep*, bool, int);
@@ -3142,6 +3144,28 @@ void _Builder<_FwdIt, _Elem, _RxTraits>::_Tidy() noexcept { // free memory
     _Root = nullptr;
 }
 
+template <class _BidIt, class _Elem, class _RxTraits, class _It>
+bool _Matcher<_BidIt, _Elem, _RxTraits, _It>::_Do_assert(_Node_assert* _Node) { // apply assert node
+    _It _Ch = _Tgt_state._Cur;
+    if (_Match_pat(_Node->_Child)) {
+        _Tgt_state._Cur = _Ch;
+        return true;
+    } else {
+        return false;
+    }
+}
+
+template <class _BidIt, class _Elem, class _RxTraits, class _It>
+bool _Matcher<_BidIt, _Elem, _RxTraits, _It>::_Do_neg_assert(_Node_assert* _Node) { // apply negative assert node
+    _Bt_state_t<_It> _St = _Tgt_state;
+    if (!_Match_pat(_Node->_Child)) {
+        _Tgt_state = _St;
+        return true;
+    } else {
+        return false;
+    }
+}
+
 template <class _BidIt, class _Elem, class _RxTraits, class _It>
 bool _Matcher<_BidIt, _Elem, _RxTraits, _It>::_Do_if(_Node_if* _Node) { // apply if node
     _Tgt_state_t<_It> _St = _Tgt_state;
@@ -3597,20 +3621,15 @@ bool _Matcher<_BidIt, _Elem, _RxTraits, _It>::_Match_pat(_Node_base* _Nx) { // c
         case _N_end_group:
             break;
 
-        case _N_neg_assert:
         case _N_assert:
             { // check assert
-                _It _Ch              = _Tgt_state._Cur;
-                bool _Neg            = _Nx->_Kind == _N_neg_assert;
-                _Bt_state_t<_It> _St = _Tgt_state;
-                if (_Match_pat(static_cast<_Node_assert*>(_Nx)->_Child) == _Neg) {
-                    // restore initial state and indicate failure
-                    _Tgt_state = _St;
-                    _Failed    = true;
-                } else {
-                    _Tgt_state._Cur = _Ch;
-                }
+                _Failed = !_Do_assert(static_cast<_Node_assert*>(_Nx));
+                break;
+            }
 
+        case _N_neg_assert:
+            { // check negative assert
+                _Failed = !_Do_neg_assert(static_cast<_Node_assert*>(_Nx));
                 break;
             }
 
diff --git a/tests/std/tests/VSO_0000000_regex_use/test.cpp b/tests/std/tests/VSO_0000000_regex_use/test.cpp
@@ -1150,6 +1150,40 @@ void test_gh_5214() {
     }
 }
 
+void test_gh_5245() {
+    // GH-5245: <regex>: Successful negative lookahead assertions
+    // sometimes mistakenly assign matches to capture groups
+    {
+        test_regex neg_assert(&g_regexTester, "^(?!(a)b)..$");
+        neg_assert.should_search_fail("ab"); // rejected by the negative assertion
+        neg_assert.should_search_match_capture_groups("ac", "ac", match_default, {{-1, -1}}); // test the fix
+        neg_assert.should_search_match_capture_groups("cb", "cb", match_default, {{-1, -1}}); // never captures
+
+        // These 3-character and 4-character tests verify that after a lookahead assertion, we reset the position:
+        neg_assert.should_search_fail("abb");
+        neg_assert.should_search_fail("acc");
+        neg_assert.should_search_fail("cbb");
+        neg_assert.should_search_fail("abab");
+        neg_assert.should_search_fail("abcc");
+        neg_assert.should_search_fail("accc");
+    }
+
+    {
+        test_regex pos_assert(&g_regexTester, "^(?=(a)b)..$");
+        pos_assert.should_search_match_capture_groups("ab", "ab", match_default, {{0, 1}}); // capture group retained
+        pos_assert.should_search_fail("ac"); // rejected by the positive assertion midway through
+        pos_assert.should_search_fail("cb"); // rejected by the positive assertion immediately
+
+        // These 3-character and 4-character tests verify that after a lookahead assertion, we reset the position:
+        pos_assert.should_search_fail("abb");
+        pos_assert.should_search_fail("acc");
+        pos_assert.should_search_fail("cbb");
+        pos_assert.should_search_fail("abab");
+        pos_assert.should_search_fail("abcc");
+        pos_assert.should_search_fail("accc");
+    }
+}
+
 void test_gh_5253() {
     // GH-5253 cleaned up parsing logic for quantifiers that were applied to single characters
     g_regexTester.should_match("abbb", "ab*");
@@ -1436,6 +1470,7 @@ int main() {
     test_gh_5167();
     test_gh_5192();
     test_gh_5214();
+    test_gh_5245();
     test_gh_5253();
     test_gh_5362();
     test_gh_5364();
