lib/glibc
lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-06-03 13:22:05 +03:00
Code

glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332]

Browse Source
This commit is contained in:
Paul Eggert 2017-10-22 10:00:57 +02:00 committed by Florian Weimer
parent 914c9994d2
commit a159b53fa0
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2017-10-22 Paul Eggert <eggert@cs.ucla.edu>
[BZ #22332]
* posix/glob.c (__glob): Fix buffer overflow during GLOB_TILDE
unescaping.
2017-10-21 Florian Weimer <fweimer@redhat.com> 2017-10-21 Florian Weimer <fweimer@redhat.com>
* posix/Makefile (tests): Add tst-glob-tilde. * posix/Makefile (tests): Add tst-glob-tilde.

4
NEWS
View File

@ -82,6 +82,10 @@ Security related changes:
processing, leading to a memory leak and, potentially, to a denial processing, leading to a memory leak and, potentially, to a denial
of service. of service.
The glob function, when invoked with GLOB_TILDE and without
GLOB_NOESCAPE, could write past the end of a buffer while
unescaping user names. Reported by Tim Rühsen.
The following bugs are resolved with this release: The following bugs are resolved with this release:
[The release manager will add the list generated by [The release manager will add the list generated by

4
posix/glob.c
View File

@ -770,11 +770,11 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
char *p = mempcpy (newp, dirname + 1, char *p = mempcpy (newp, dirname + 1,
unescape - dirname - 1); unescape - dirname - 1);
char *q = unescape; char *q = unescape;
while (*q != '\0') while (q != end_name)
{ {
if (*q == '\\') if (*q == '\\')
{ {
if (q[1] == '\0') if (q + 1 == end_name)
{ {
/* "~fo\\o\\" unescape to user_name "foo\\", /* "~fo\\o\\" unescape to user_name "foo\\",
but "~fo\\o\\/" unescape to user_name but "~fo\\o\\/" unescape to user_name