AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-21 20:40:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332]

Browse Source
This commit is contained in:
Paul Eggert 2017-10-22 10:00:57 +02:00 committed by Florian Weimer
parent 914c9994d2
commit a159b53fa0
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2017-10-22 Paul Eggert <eggert@cs.ucla.edu>
[BZ #22332]
* posix/glob.c (__glob): Fix buffer overflow during GLOB_TILDE
unescaping.
2017-10-21 Florian Weimer <fweimer@redhat.com>
* posix/Makefile (tests): Add tst-glob-tilde.

4
NEWS
View File

@ -82,6 +82,10 @@ Security related changes:
processing, leading to a memory leak and, potentially, to a denial
of service.
The glob function, when invoked with GLOB_TILDE and without
GLOB_NOESCAPE, could write past the end of a buffer while
unescaping user names. Reported by Tim Rühsen.
The following bugs are resolved with this release:
[The release manager will add the list generated by

4
posix/glob.c
View File

@ -770,11 +770,11 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
char *p = mempcpy (newp, dirname + 1,
unescape - dirname - 1);
char *q = unescape;
while (*q != '\0')
while (q != end_name)
{
if (*q == '\\')
{
if (q[1] == '\0')
if (q + 1 == end_name)
{
/* "~fo\\o\\" unescape to user_name "foo\\",
but "~fo\\o\\/" unescape to user_name