From: Paul Eggert Date: Sat, 21 Oct 2017 19:20:29 +0000 (-0700) Subject: glob: fix another heap buffer overflow X-Git-Tag: v1.0~5864 X-Git-Url: https://gitweb.git.savannah.gnu.org/gitweb/?a=commitdiff_plain;h=6803dda53781f7da920f568a31610d41e5c3a351;p=gnulib.git glob: fix another heap buffer overflow Problem reported by Tim Rühsen in: https://sourceware.org/bugzilla/show_bug.cgi?id=22332 * lib/glob.c (glob): Avoid buffer overrun when unescaping. --- diff --git a/ChangeLog b/ChangeLog index ed34aa80f3..23b8c0e8e2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2017-10-21 Paul Eggert + + glob: fix another heap buffer overflow + Problem reported by Tim Rühsen in: + https://sourceware.org/bugzilla/show_bug.cgi?id=22332 + * lib/glob.c (glob): Avoid buffer overrun when unescaping. + 2017-10-19 Paul Eggert quotearg: pacify compiler re unsigned diff --git a/lib/glob.c b/lib/glob.c index 67530431e4..511be12dda 100644 --- a/lib/glob.c +++ b/lib/glob.c @@ -744,11 +744,11 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int), char *p = mempcpy (newp, dirname + 1, unescape - dirname - 1); char *q = unescape; - while (*q != '\0') + while (q != end_name) { if (*q == '\\') { - if (q[1] == '\0') + if (q + 1 == end_name) { /* "~fo\\o\\" unescape to user_name "foo\\", but "~fo\\o\\/" unescape to user_name