diff mbox

[COMMITTED] glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332]

Message ID 66bacac5-3e36-9ee6-b0fd-22def0629bf4@redhat.com
State Committed
Headers

Commit Message

Florian Weimer Oct. 22, 2017, 8:06 a.m. UTC 
  Imported from gnulib.

Thanks,
Florian
diff mbox

Patch


From: Paul Eggert <eggert@cs.ucla.edu>


2017-10-22  Paul Eggert <eggert@cs.ucla.edu>

	[BZ #22332]
	* posix/glob.c (__glob): Fix buffer overflow during GLOB_TILDE
	unescaping.

diff --git a/NEWS b/NEWS
index c38fb88ac4..8e040f1f3b 100644
--- a/NEWS
+++ b/NEWS
@@ -82,6 +82,10 @@  Security related changes:
   processing, leading to a memory leak and, potentially, to a denial
   of service.
 
+  The glob function, when invoked with GLOB_TILDE and without
+  GLOB_NOESCAPE, could write past the end of a buffer while
+  unescaping user names.  Reported by Tim Rühsen.
+
 The following bugs are resolved with this release:
 
   [The release manager will add the list generated by
diff --git a/posix/glob.c b/posix/glob.c
index 15a6c0cf13..cb39779d07 100644
--- a/posix/glob.c
+++ b/posix/glob.c
@@ -770,11 +770,11 @@  __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
 		  char *p = mempcpy (newp, dirname + 1,
 				     unescape - dirname - 1);
 		  char *q = unescape;
-		  while (*q != '\0')
+		  while (q != end_name)
 		    {
 		      if (*q == '\\')
 			{
-			  if (q[1] == '\0')
+			  if (q + 1 == end_name)
 			    {
 			      /* "~fo\\o\\" unescape to user_name "foo\\",
 				 but "~fo\\o\\/" unescape to user_name