diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c index 72c5d8f..f46c9df 100644 --- a/posix/fnmatch_loop.c +++ b/posix/fnmatch_loop.c @@ -1036,7 +1036,12 @@ END (const CHAR *pattern) } else if ((*p == L('?') || *p == L('*') || *p == L('+') || *p == L('@') || *p == L('!')) && p[1] == L('(')) - p = END (p + 1); + { + p = END (p + 1); + if (*p == L('\0')) + /* This is an invalid pattern. */ + return pattern; + } else if (*p == L(')')) break; diff --git a/posix/tst-fnmatch3.c b/posix/tst-fnmatch3.c index 75bc00a..fdf9934 100644 --- a/posix/tst-fnmatch3.c +++ b/posix/tst-fnmatch3.c @@ -17,6 +17,26 @@ . */ #include +#include +#include +#include + +int +do_bz18036 (void) +{ + const char p[] = "**(!()"; + const int pagesize = getpagesize (); + + char *pattern = mmap (0, 2 * pagesize, PROT_READ|PROT_WRITE, + MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); + if (pattern == MAP_FAILED) return 1; + + mprotect (pattern + pagesize, pagesize, PROT_NONE); + memset (pattern, ' ', pagesize); + strcpy (pattern, p); + + return fnmatch (pattern, p, FNM_EXTMATCH); +} int do_test (void) @@ -25,7 +45,7 @@ do_test (void) return 1; if (fnmatch ("[a[.\0.]]", "a", 0) != FNM_NOMATCH) return 1; - return 0; + return do_bz18036 (); } #define TEST_FUNCTION do_test ()