diff options
| author | Florian Weimer <fweimer@redhat.com> | 2016-05-04 12:09:35 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2016-05-04 12:09:35 +0200 |
| commit | 5171f3079f2cc53e0548fc4967361f4d1ce9d7ea (patch) | |
| tree | 3d23357f6313d2d00017bf641fd61a3dc9459105 /posix/bug-glob2.c | |
| parent | 2faba597eca15666ce46cc721041747e96c8b942 (diff) | |
| download | glibc-5171f3079f2cc53e0548fc4967361f4d1ce9d7ea.zip glibc-5171f3079f2cc53e0548fc4967361f4d1ce9d7ea.tar.gz glibc-5171f3079f2cc53e0548fc4967361f4d1ce9d7ea.tar.bz2 | |
CVE-2016-1234: glob: Do not copy d_name field of struct dirent [BZ #19779]
Instead, we store the data we need from the return value of
readdir in an object of the new type struct readdir_result.
This type is independent of the layout of struct dirent.
Diffstat (limited to 'posix/bug-glob2.c')
| -rw-r--r-- | posix/bug-glob2.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/posix/bug-glob2.c b/posix/bug-glob2.c index 0fdc5d0..5873e08 100644 --- a/posix/bug-glob2.c +++ b/posix/bug-glob2.c @@ -40,6 +40,17 @@ # define PRINTF(fmt, args...) #endif +#define LONG_NAME \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" static struct { @@ -58,6 +69,7 @@ static struct { ".", 3, DT_DIR, 0755 }, { "..", 3, DT_DIR, 0755 }, { "a", 3, DT_REG, 0644 }, + { LONG_NAME, 3, DT_REG, 0644 }, { "unreadable", 2, DT_DIR, 0111 }, { ".", 3, DT_DIR, 0111 }, { "..", 3, DT_DIR, 0755 }, @@ -75,7 +87,7 @@ typedef struct int level; int idx; struct dirent d; - char room_for_dirent[NAME_MAX]; + char room_for_dirent[sizeof (LONG_NAME)]; } my_DIR; |