diff mbox

Fix read past end of pattern in fnmatch (bug 18032)

Message ID mvmk2z4ydpx.fsf@hawking.suse.de
State Committed
Headers

Commit Message

Andreas Schwab Feb. 26, 2015, 2 p.m. UTC 
  [BZ #18032]
	* posix/fnmatch_loop.c (FCT): Remove extra increment when skipping
	over collating symbol inside a bracket expression.
	* posix/tst-fnmatch3.c (do_test): Add test case.
---
 posix/fnmatch_loop.c | 5 ++---
 posix/tst-fnmatch3.c | 8 +++++---
 2 files changed, 7 insertions(+), 6 deletions(-)

Comments

Florian Weimer Feb. 26, 2015, 2:26 p.m. UTC | #1 
On 02/26/2015 03:00 PM, Andreas Schwab wrote:
> 	[BZ #18032]
> 	* posix/fnmatch_loop.c (FCT): Remove extra increment when skipping
> 	over collating symbol inside a bracket expression.
> 	* posix/tst-fnmatch3.c (do_test): Add test case.

The changelog does not mention the other change.  Otherwise okay.
diff mbox

Patch

diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c
index 60e7ccb..8980c6c 100644
--- a/posix/fnmatch_loop.c
+++ b/posix/fnmatch_loop.c
@@ -892,14 +892,13 @@  FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
 		  }
 		else if (c == L('[') && *p == L('.'))
 		  {
-		    ++p;
 		    while (1)
 		      {
 			c = *++p;
-			if (c == '\0')
+			if (c == L('\0'))
 			  return FNM_NOMATCH;
 
-			if (*p == L('.') && p[1] == L(']'))
+			if (c == L('.') && p[1] == L(']'))
 			  break;
 		      }
 		    p += 2;
diff --git a/posix/tst-fnmatch3.c b/posix/tst-fnmatch3.c
index d27a557..75bc00a 100644
--- a/posix/tst-fnmatch3.c
+++ b/posix/tst-fnmatch3.c
@@ -21,9 +21,11 @@ 
 int
 do_test (void)
 {
-  const char *pattern = "[[:alpha:]'[:alpha:]\0]";
-
-  return fnmatch (pattern, "a", 0) != FNM_NOMATCH;
+  if (fnmatch ("[[:alpha:]'[:alpha:]\0]", "a", 0) != FNM_NOMATCH)
+    return 1;
+  if (fnmatch ("[a[.\0.]]", "a", 0) != FNM_NOMATCH)
+    return 1;
+  return 0;
 }
 
 #define TEST_FUNCTION do_test ()