]> Savannah Git Hosting - gnulib.git/commitdiff
glob: fix another heap buffer overflow
authorPaul Eggert <eggert@cs.ucla.edu>
Sat, 21 Oct 2017 19:20:29 +0000 (12:20 -0700)
committerPaul Eggert <eggert@cs.ucla.edu>
Sat, 21 Oct 2017 19:20:55 +0000 (12:20 -0700)
Problem reported by Tim Rühsen in:
https://sourceware.org/bugzilla/show_bug.cgi?id=22332
* lib/glob.c (glob): Avoid buffer overrun when unescaping.

ChangeLog
lib/glob.c

index ed34aa80f3ff455725883e5bceaa43275298978b..23b8c0e8e28839efebff03d11bfa3eb0449b2ec7 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2017-10-21  Paul Eggert  <eggert@cs.ucla.edu>
+
+       glob: fix another heap buffer overflow
+       Problem reported by Tim Rühsen in:
+       https://sourceware.org/bugzilla/show_bug.cgi?id=22332
+       * lib/glob.c (glob): Avoid buffer overrun when unescaping.
+
 2017-10-19  Paul Eggert  <eggert@cs.ucla.edu>
 
        quotearg: pacify compiler re unsigned
index 67530431e4b82a3f76c07a573607b00534029365..511be12dda3392bbacbe01cb47e0036fa8c07dee 100644 (file)
@@ -744,11 +744,11 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
                   char *p = mempcpy (newp, dirname + 1,
                                      unescape - dirname - 1);
                   char *q = unescape;
-                  while (*q != '\0')
+                  while (q != end_name)
                     {
                       if (*q == '\\')
                         {
-                          if (q[1] == '\0')
+                          if (q + 1 == end_name)
                             {
                               /* "~fo\\o\\" unescape to user_name "foo\\",
                                  but "~fo\\o\\/" unescape to user_name