[PATCH 2.22 02/14] CVE-2017-15670: glob: Fix one-byte overflow [BZ #22320]

[Raphael Moreira Zinsly]

From: Paul Eggert <eggert@cs.ucla.edu>

(cherry picked from commit c369d66e5426a30e4725b100d5cd28e372754f90)
---
 ChangeLog    | 6 ++++++
 NEWS         | 5 +++++
 posix/glob.c | 2 +-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 643aeb9..4c96691 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-10-20  Paul Eggert <eggert@cs.ucla.edu>
+
+	[BZ #22320]
+	CVE-2017-15670
+	* posix/glob.c (__glob): Fix one-byte overflow.
+
 2017-08-16  Andreas Schwab  <schwab@suse.de>
 
 	* elf/ldd.bash.in: Never run file directly.
diff --git a/NEWS b/NEWS
index a19f656..069b3ea 100644
--- a/NEWS
+++ b/NEWS
@@ -63,6 +63,11 @@ Version 2.22.1
 * The Sun RPC UDP client could exhaust all available stack space when
   flooded with crafted ICMP and UDP messages.  Reported by Aldy Hernandez'
   alloca plugin for GCC.  (CVE-2016-4429)
+
+* CVE-2017-15670: The glob function, when invoked with GLOB_TILDE, suffered
+  from a one-byte overflow during ~ operator processing (either on the stack
+  or the heap, depending on the length of the user name).
+
 
 Version 2.22
 
diff --git a/posix/glob.c b/posix/glob.c
index 60fa6c5..40496a0 100644
--- a/posix/glob.c
+++ b/posix/glob.c
@@ -859,7 +859,7 @@ glob (pattern, flags, errfunc, pglob)
 		  *p = '\0';
 		}
 	      else
-		*((char *) mempcpy (newp, dirname + 1, end_name - dirname))
+		*((char *) mempcpy (newp, dirname + 1, end_name - dirname - 1))
 		  = '\0';
 	      user_name = newp;
 	    }
-- 
1.8.3.1