From: Paul Eggert Date: Thu, 19 Oct 2017 19:39:45 +0000 (-0700) Subject: glob: fix heap buffer overflow X-Git-Tag: v1.0~5866 X-Git-Url: https://gitweb.git.savannah.gnu.org/gitweb/?a=commitdiff_plain;h=2d1bd71ec70a31b01d01b734faa66bb1ed28961f;p=gnulib.git glob: fix heap buffer overflow * lib/glob.c (glob): Fix off-by-one error introduced into glibc in commit dd7d45e838a42b0ed470c44b55901ea98d0c2bab dated 1997-10-29 20:33:40. Problem reported by Tim Rühsen in: https://sourceware.org/bugzilla/show_bug.cgi?id=22320 Fix suggested by Bruno Haible. --- diff --git a/ChangeLog b/ChangeLog index b280a7753d..e662c02a57 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +2017-10-19 Paul Eggert + + glob: fix heap buffer overflow + * lib/glob.c (glob): Fix off-by-one error introduced into + glibc in commit dd7d45e838a42b0ed470c44b55901ea98d0c2bab + dated 1997-10-29 20:33:40. Problem reported by Tim Rühsen in: + https://sourceware.org/bugzilla/show_bug.cgi?id=22320 + Fix suggested by Bruno Haible. + 2017-10-18 Paul Eggert glob: pacify fuzzer for mempcpy diff --git a/lib/glob.c b/lib/glob.c index 33030ec72b..67530431e4 100644 --- a/lib/glob.c +++ b/lib/glob.c @@ -764,7 +764,7 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int), *p = '\0'; } else - *((char *) mempcpy (newp, dirname + 1, end_name - dirname)) + *((char *) mempcpy (newp, dirname + 1, end_name - dirname - 1)) = '\0'; user_name = newp; }