Problem reported by Tim Rühsen in:
https://sourceware.org/bugzilla/show_bug.cgi?id=22332
* lib/glob.c (glob): Avoid buffer overrun when unescaping.
+2017-10-21 Paul Eggert <eggert@cs.ucla.edu>
+
+ glob: fix another heap buffer overflow
+ Problem reported by Tim Rühsen in:
+ https://sourceware.org/bugzilla/show_bug.cgi?id=22332
+ * lib/glob.c (glob): Avoid buffer overrun when unescaping.
+
2017-10-19 Paul Eggert <eggert@cs.ucla.edu>
quotearg: pacify compiler re unsigned
char *p = mempcpy (newp, dirname + 1,
unescape - dirname - 1);
char *q = unescape;
- while (*q != '\0')
+ while (q != end_name)
{
if (*q == '\\')
{
- if (q[1] == '\0')
+ if (q + 1 == end_name)
{
/* "~fo\\o\\" unescape to user_name "foo\\",
but "~fo\\o\\/" unescape to user_name