mirrors/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-23 17:53:37 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332]

Browse Source 
(cherry picked from commit a159b53fa0)
This commit is contained in:
Paul Eggert 2017-10-22 10:00:57 +02:00 committed by Aurelien Jarno
parent 6f9f307b5d
commit f1cf98b583
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2017-10-22 Paul Eggert <eggert@cs.ucla.edu>
[BZ #22332]
* posix/glob.c (__glob): Fix buffer overflow during GLOB_TILDE
unescaping.
2017-10-23 Wilco Dijkstra <wdijkstr@arm.com>
* malloc/malloc.c (_int_malloc): Add SINGLE_THREAD_P path.

4
NEWS
View File

@ -35,6 +35,10 @@ Security related changes:
processing, leading to a memory leak and, potentially, to a denial
of service.
The glob function, when invoked with GLOB_TILDE and without
GLOB_NOESCAPE, could write past the end of a buffer while
unescaping user names. Reported by Tim Rühsen.
The following bugs are resolved with this release:
[16750] ldd: Never run file directly.

4
posix/glob.c
View File

@ -850,11 +850,11 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
char *p = mempcpy (newp, dirname + 1,
unescape - dirname - 1);
char *q = unescape;
while (*q != '\0')
while (q != end_name)
{
if (*q == '\\')
{
if (q[1] == '\0')
if (q + 1 == end_name)
{
/* "~fo\\o\\" unescape to user_name "foo\\",
but "~fo\\o\\/" unescape to user_name