aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog6
-rw-r--r--NEWS4
-rw-r--r--posix/glob.c4
3 files changed, 12 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index bc15aef..d2f0858 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2017-10-22 Paul Eggert <eggert@cs.ucla.edu>
+
+ [BZ #22332]
+ * posix/glob.c (__glob): Fix buffer overflow during GLOB_TILDE
+ unescaping.
+
2017-10-21 Florian Weimer <fweimer@redhat.com>
* posix/Makefile (tests): Add tst-glob-tilde.
diff --git a/NEWS b/NEWS
index c38fb88..8e040f1 100644
--- a/NEWS
+++ b/NEWS
@@ -82,6 +82,10 @@ Security related changes:
processing, leading to a memory leak and, potentially, to a denial
of service.
+ The glob function, when invoked with GLOB_TILDE and without
+ GLOB_NOESCAPE, could write past the end of a buffer while
+ unescaping user names. Reported by Tim Rühsen.
+
The following bugs are resolved with this release:
[The release manager will add the list generated by
diff --git a/posix/glob.c b/posix/glob.c
index 15a6c0c..cb39779 100644
--- a/posix/glob.c
+++ b/posix/glob.c
@@ -770,11 +770,11 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
char *p = mempcpy (newp, dirname + 1,
unescape - dirname - 1);
char *q = unescape;
- while (*q != '\0')
+ while (q != end_name)
{
if (*q == '\\')
{
- if (q[1] == '\0')
+ if (q + 1 == end_name)
{
/* "~fo\\o\\" unescape to user_name "foo\\",
but "~fo\\o\\/" unescape to user_name