This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
[PATCH COMMITTED] glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332]
- From: Florian Weimer <fweimer at redhat dot com>
- To: GNU C Library <libc-alpha at sourceware dot org>
- Date: Sun, 22 Oct 2017 10:06:20 +0200
- Subject: [PATCH COMMITTED] glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332]
- Authentication-results: sourceware.org; auth=none
- Authentication-results: ext-mx04.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com
- Authentication-results: ext-mx04.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=fweimer at redhat dot com
- Dmarc-filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 92CA380468
Imported from gnulib.
Thanks,
Florian
From: Paul Eggert <eggert@cs.ucla.edu>
2017-10-22 Paul Eggert <eggert@cs.ucla.edu>
[BZ #22332]
* posix/glob.c (__glob): Fix buffer overflow during GLOB_TILDE
unescaping.
diff --git a/NEWS b/NEWS
index c38fb88ac4..8e040f1f3b 100644
--- a/NEWS
+++ b/NEWS
@@ -82,6 +82,10 @@ Security related changes:
processing, leading to a memory leak and, potentially, to a denial
of service.
+ The glob function, when invoked with GLOB_TILDE and without
+ GLOB_NOESCAPE, could write past the end of a buffer while
+ unescaping user names. Reported by Tim Rühsen.
+
The following bugs are resolved with this release:
[The release manager will add the list generated by
diff --git a/posix/glob.c b/posix/glob.c
index 15a6c0cf13..cb39779d07 100644
--- a/posix/glob.c
+++ b/posix/glob.c
@@ -770,11 +770,11 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
char *p = mempcpy (newp, dirname + 1,
unescape - dirname - 1);
char *q = unescape;
- while (*q != '\0')
+ while (q != end_name)
{
if (*q == '\\')
{
- if (q[1] == '\0')
+ if (q + 1 == end_name)
{
/* "~fo\\o\\" unescape to user_name "foo\\",
but "~fo\\o\\/" unescape to user_name