This is the mail archive of the
glibc-cvs@sourceware.org
mailing list for the glibc project.
GNU C Library master sources branch master updated. glibc-2.26.9000-621-ga159b53
- From: fw at sourceware dot org
- To: glibc-cvs at sourceware dot org
- Date: 22 Oct 2017 08:01:55 -0000
- Subject: GNU C Library master sources branch master updated. glibc-2.26.9000-621-ga159b53
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, master has been updated
via a159b53fa059947cc2548e3b0d5bdcf7b9630ba8 (commit)
from 914c9994d27b80bc3b71c483e801a4f04e269ba6 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=a159b53fa059947cc2548e3b0d5bdcf7b9630ba8
commit a159b53fa059947cc2548e3b0d5bdcf7b9630ba8
Author: Paul Eggert <eggert@cs.ucla.edu>
Date: Sun Oct 22 10:00:57 2017 +0200
glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332]
diff --git a/ChangeLog b/ChangeLog
index bc15aef..d2f0858 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-10-22 Paul Eggert <eggert@cs.ucla.edu>
+
+ [BZ #22332]
+ * posix/glob.c (__glob): Fix buffer overflow during GLOB_TILDE
+ unescaping.
+
2017-10-21 Florian Weimer <fweimer@redhat.com>
* posix/Makefile (tests): Add tst-glob-tilde.
diff --git a/NEWS b/NEWS
index c38fb88..8e040f1 100644
--- a/NEWS
+++ b/NEWS
@@ -82,6 +82,10 @@ Security related changes:
processing, leading to a memory leak and, potentially, to a denial
of service.
+ The glob function, when invoked with GLOB_TILDE and without
+ GLOB_NOESCAPE, could write past the end of a buffer while
+ unescaping user names. Reported by Tim Rühsen.
+
The following bugs are resolved with this release:
[The release manager will add the list generated by
diff --git a/posix/glob.c b/posix/glob.c
index 15a6c0c..cb39779 100644
--- a/posix/glob.c
+++ b/posix/glob.c
@@ -770,11 +770,11 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
char *p = mempcpy (newp, dirname + 1,
unescape - dirname - 1);
char *q = unescape;
- while (*q != '\0')
+ while (q != end_name)
{
if (*q == '\\')
{
- if (q[1] == '\0')
+ if (q + 1 == end_name)
{
/* "~fo\\o\\" unescape to user_name "foo\\",
but "~fo\\o\\/" unescape to user_name
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 6 ++++++
NEWS | 4 ++++
posix/glob.c | 4 ++--
3 files changed, 12 insertions(+), 2 deletions(-)
hooks/post-receive
--
GNU C Library master sources