Reported by Tim Rühsen <tim.ruehsen@gmx.de> in
<https://lists.gnu.org/archive/html/bug-gnulib/2020-01/msg00102.html>.
* lib/glob.c (__glob): Delay freeing dirname until after the use of
end_name.
+2020-01-17 Bruno Haible <bruno@clisp.org>
+ Paul Eggert <eggert@cs.ucla.edu>
+
+ glob: Fix use-after-free bug.
+ Reported by Tim Rühsen <tim.ruehsen@gmx.de> in
+ <https://lists.gnu.org/archive/html/bug-gnulib/2020-01/msg00102.html>.
+ * lib/glob.c (__glob): Delay freeing dirname until after the use of
+ end_name.
+
2020-01-16 Siddhesh Poyarekar <siddhesh@gotplt.org>
vcs-to-changelog: Fix parsing of fndecl without args.
{
size_t home_len = strlen (p->pw_dir);
size_t rest_len = end_name == NULL ? 0 : strlen (end_name);
+ /* dirname contains end_name; we can't free it now. */
+ char *prev_dirname =
+ (__glibc_unlikely (malloc_dirname) ? dirname : NULL);
char *d;
- if (__glibc_unlikely (malloc_dirname))
- free (dirname);
malloc_dirname = 0;
if (glob_use_alloca (alloca_used, home_len + rest_len + 1))
dirname = malloc (home_len + rest_len + 1);
if (dirname == NULL)
{
+ free (prev_dirname);
scratch_buffer_free (&pwtmpbuf);
retval = GLOB_NOSPACE;
goto out;
d = mempcpy (d, end_name, rest_len);
*d = '\0';
+ free (prev_dirname);
+
dirlen = home_len + rest_len;
dirname_modified = 1;
}