about summary refs log tree commit diff
path: root/posix/bug-glob2.c
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2016-05-04 12:09:35 +0200
committerFlorian Weimer <fweimer@redhat.com>2016-05-04 12:09:35 +0200
commit5171f3079f2cc53e0548fc4967361f4d1ce9d7ea (patch)
tree3d23357f6313d2d00017bf641fd61a3dc9459105 /posix/bug-glob2.c
parent2faba597eca15666ce46cc721041747e96c8b942 (diff)
downloadglibc-5171f3079f2cc53e0548fc4967361f4d1ce9d7ea.tar.gz
glibc-5171f3079f2cc53e0548fc4967361f4d1ce9d7ea.tar.xz
glibc-5171f3079f2cc53e0548fc4967361f4d1ce9d7ea.zip
CVE-2016-1234: glob: Do not copy d_name field of struct dirent [BZ #19779]
Instead, we store the data we need from the return value of
readdir in an object of the new type struct readdir_result.
This type is independent of the layout of struct dirent.
Diffstat (limited to 'posix/bug-glob2.c')
-rw-r--r--posix/bug-glob2.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/posix/bug-glob2.c b/posix/bug-glob2.c
index 0fdc5d0a53..5873e08550 100644
--- a/posix/bug-glob2.c
+++ b/posix/bug-glob2.c
@@ -40,6 +40,17 @@
 # define PRINTF(fmt, args...)
 #endif
 
+#define LONG_NAME \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
+  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
 
 static struct
 {
@@ -58,6 +69,7 @@ static struct
       { ".", 3, DT_DIR, 0755 },
       { "..", 3, DT_DIR, 0755 },
       { "a", 3, DT_REG, 0644 },
+      { LONG_NAME, 3, DT_REG, 0644 },
     { "unreadable", 2, DT_DIR, 0111 },
       { ".", 3, DT_DIR, 0111 },
       { "..", 3, DT_DIR, 0755 },
@@ -75,7 +87,7 @@ typedef struct
   int level;
   int idx;
   struct dirent d;
-  char room_for_dirent[NAME_MAX];
+  char room_for_dirent[sizeof (LONG_NAME)];
 } my_DIR;