From 6803dda53781f7da920f568a31610d41e5c3a351 Mon Sep 17 00:00:00 2001 From: Paul Eggert Date: Sat, 21 Oct 2017 12:20:29 -0700 Subject: [PATCH] glob: fix another heap buffer overflow MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Problem reported by Tim Rühsen in: https://sourceware.org/bugzilla/show_bug.cgi?id=22332 * lib/glob.c (glob): Avoid buffer overrun when unescaping. --- ChangeLog | 7 +++++++ lib/glob.c | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index ed34aa80f3..23b8c0e8e2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2017-10-21 Paul Eggert + + glob: fix another heap buffer overflow + Problem reported by Tim Rühsen in: + https://sourceware.org/bugzilla/show_bug.cgi?id=22332 + * lib/glob.c (glob): Avoid buffer overrun when unescaping. + 2017-10-19 Paul Eggert quotearg: pacify compiler re unsigned diff --git a/lib/glob.c b/lib/glob.c index 67530431e4..511be12dda 100644 --- a/lib/glob.c +++ b/lib/glob.c @@ -744,11 +744,11 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int), char *p = mempcpy (newp, dirname + 1, unescape - dirname - 1); char *q = unescape; - while (*q != '\0') + while (q != end_name) { if (*q == '\\') { - if (q[1] == '\0') + if (q + 1 == end_name) { /* "~fo\\o\\" unescape to user_name "foo\\", but "~fo\\o\\/" unescape to user_name -- 2.39.5