* lib/glob.c (glob): Fix off-by-one error introduced into
glibc in commit
dd7d45e838a42b0ed470c44b55901ea98d0c2bab
dated 1997-10-29 20:33:40. Problem reported by Tim Rühsen in:
https://sourceware.org/bugzilla/show_bug.cgi?id=22320
Fix suggested by Bruno Haible.
+2017-10-19 Paul Eggert <eggert@cs.ucla.edu>
+
+ glob: fix heap buffer overflow
+ * lib/glob.c (glob): Fix off-by-one error introduced into
+ glibc in commit dd7d45e838a42b0ed470c44b55901ea98d0c2bab
+ dated 1997-10-29 20:33:40. Problem reported by Tim Rühsen in:
+ https://sourceware.org/bugzilla/show_bug.cgi?id=22320
+ Fix suggested by Bruno Haible.
+
2017-10-18 Paul Eggert <eggert@cs.ucla.edu>
glob: pacify fuzzer for mempcpy
*p = '\0';
}
else
- *((char *) mempcpy (newp, dirname + 1, end_name - dirname))
+ *((char *) mempcpy (newp, dirname + 1, end_name - dirname - 1))
= '\0';
user_name = newp;
}