AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-12 16:20:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix use-after-free in glob when expanding ~user (bug 25414)

Browse Source 
The value of `end_name' points into the value of `dirname', thus don't
deallocate the latter before the last use of the former.
This commit is contained in:
Andreas Schwab 2020-02-19 17:21:46 +01:00 committed by Fangrui Song
parent 6db4535a70
commit 2887b50077
1 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
posix/glob.c
View File

@ -827,31 +827,32 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
{
size_t home_len = strlen (p->pw_dir);
size_t rest_len = end_name == NULL ? 0 : strlen (end_name);
char *d;
char *d, *newp;
bool use_alloca = glob_use_alloca (alloca_used,
home_len + rest_len + 1);
if (__glibc_unlikely (malloc_dirname))
free (dirname);
malloc_dirname = 0;
if (glob_use_alloca (alloca_used, home_len + rest_len + 1))
dirname = alloca_account (home_len + rest_len + 1,
alloca_used);
if (use_alloca)
newp = alloca_account (home_len + rest_len + 1, alloca_used);
else
{
dirname = malloc (home_len + rest_len + 1);
if (dirname == NULL)
newp = malloc (home_len + rest_len + 1);
if (newp == NULL)
{
scratch_buffer_free (&pwtmpbuf);
retval = GLOB_NOSPACE;
goto out;
}
malloc_dirname = 1;
}
d = mempcpy (dirname, p->pw_dir, home_len);
d = mempcpy (newp, p->pw_dir, home_len);
if (end_name != NULL)
d = mempcpy (d, end_name, rest_len);
*d = '\0';
if (__glibc_unlikely (malloc_dirname))
free (dirname);
dirname = newp;
malloc_dirname = !use_alloca;
dirlen = home_len + rest_len;
dirname_modified = 1;
}