about summary refs log tree commit diff
path: root/posix/fnmatch_loop.c
diff options
context:
space:
mode:
authorAndreas Schwab <schwab@suse.de>2014-06-18 11:58:45 +0200
committerAndreas Schwab <schwab@suse.de>2014-06-18 14:20:02 +0200
commitb3a9f56ba59c3d8eadd3135a1c25c37a63151450 (patch)
tree7a579450ac5496123e6bb4ff2e46a41344d29707 /posix/fnmatch_loop.c
parent85d89278568b4191da3b2fee589553e90b54ffa5 (diff)
downloadglibc-b3a9f56ba59c3d8eadd3135a1c25c37a63151450.tar.gz
glibc-b3a9f56ba59c3d8eadd3135a1c25c37a63151450.tar.xz
glibc-b3a9f56ba59c3d8eadd3135a1c25c37a63151450.zip
Don't read past end of pattern in fnmatch (BZ #17062)
Diffstat (limited to 'posix/fnmatch_loop.c')
-rw-r--r--posix/fnmatch_loop.c13
1 files changed, 3 insertions, 10 deletions
diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c
index f79d051a3a..544769b4f6 100644
--- a/posix/fnmatch_loop.c
+++ b/posix/fnmatch_loop.c
@@ -899,11 +899,8 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
 
 	  matched:
 	    /* Skip the rest of the [...] that already matched.  */
-	    do
+	    while ((c = *p++) != L (']'))
 	      {
-	      ignore_next:
-		c = *p++;
-
 		if (c == L('\0'))
 		  /* [... (unterminated) loses.  */
 		  return FNM_NOMATCH;
@@ -931,12 +928,11 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
 
 			if (c < L('a') || c >= L('z'))
 			  {
-			    p = startp;
-			    goto ignore_next;
+			    p = startp - 2;
+			    break;
 			  }
 		      }
 		    p += 2;
-		    c = *p++;
 		  }
 		else if (c == L('[') && *p == L('='))
 		  {
@@ -947,7 +943,6 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
 		    if (c != L('=') || p[1] != L(']'))
 		      return FNM_NOMATCH;
 		    p += 2;
-		    c = *p++;
 		  }
 		else if (c == L('[') && *p == L('.'))
 		  {
@@ -962,10 +957,8 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
 			  break;
 		      }
 		    p += 2;
-		    c = *p++;
 		  }
 	      }
-	    while (c != L(']'));
 	    if (not)
 	      return FNM_NOMATCH;
 	  }