From: Paul Eggert Date: Wed, 18 Oct 2017 17:19:35 +0000 (-0700) Subject: glob: pacify fuzzer for mempcpy X-Git-Tag: v1.0~5867 X-Git-Url: https://gitweb.git.savannah.gnu.org/gitweb/?a=commitdiff_plain;h=0e14f025d2ad40e9fbe4222e3fda328df107e761;p=gnulib.git glob: pacify fuzzer for mempcpy Problem reported by Tim Rühsen in: https://lists.gnu.org/archive/html/bug-gnulib/2017-10/msg00054.html * lib/glob.c (glob): Do not pass NULL to mempcpy. --- diff --git a/ChangeLog b/ChangeLog index 5e0c3c7f22..b280a7753d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2017-10-18 Paul Eggert + + glob: pacify fuzzer for mempcpy + Problem reported by Tim Rühsen in: + https://lists.gnu.org/archive/html/bug-gnulib/2017-10/msg00054.html + * lib/glob.c (glob): Do not pass NULL to mempcpy. + 2017-10-12 Bruno Haible doc: Fix syntax error (regression from 2017-10-03). diff --git a/lib/glob.c b/lib/glob.c index 9d677d9826..33030ec72b 100644 --- a/lib/glob.c +++ b/lib/glob.c @@ -800,6 +800,7 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int), { size_t home_len = strlen (p->pw_dir); size_t rest_len = end_name == NULL ? 0 : strlen (end_name); + char *d; if (__glibc_unlikely (malloc_dirname)) free (dirname); @@ -819,8 +820,10 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int), } malloc_dirname = 1; } - *((char *) mempcpy (mempcpy (dirname, p->pw_dir, home_len), - end_name, rest_len)) = '\0'; + d = mempcpy (dirname, p->pw_dir, home_len); + if (end_name != NULL) + d = mempcpy (d, end_name, rest_len); + *d = '\0'; dirlen = home_len + rest_len; dirname_modified = 1;