From fe7b1136e5753c85b3ccc8395dfc66b82052d73c Mon Sep 17 00:00:00 2001 From: Andreas Schwab Date: Thu, 26 Feb 2015 14:55:24 +0100 Subject: Fix read past end of pattern in fnmatch (bug 18032) (cherry picked from commit 4a28f4d55a6cc33474c0792fe93b5942d81bf185) --- ChangeLog | 7 +++++++ NEWS | 2 +- posix/fnmatch_loop.c | 5 ++--- posix/tst-fnmatch3.c | 8 +++++--- 4 files changed, 15 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 76d3e96844..928b226708 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2015-02-26 Andreas Schwab + + [BZ #18032] + * posix/fnmatch_loop.c (FCT): Remove extra increment when skipping + over collating symbol inside a bracket expression. Minor cleanup. + * posix/tst-fnmatch3.c (do_test): Add test case. + 2015-07-21 Mike Frysinger [BZ #18694] diff --git a/NEWS b/NEWS index f9b359a5b7..09fddab41d 100644 --- a/NEWS +++ b/NEWS @@ -9,7 +9,7 @@ Version 2.21.1 * The following bugs are resolved with this release: - 17949, 18287, 18694. + 17949, 18032, 18287, 18694. * A buffer overflow in gethostbyname_r and related functions performing DNS requests has been fixed. If the NSS functions were called with a diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c index c0cb2fc3e6..72c5d8f041 100644 --- a/posix/fnmatch_loop.c +++ b/posix/fnmatch_loop.c @@ -945,14 +945,13 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used) } else if (c == L('[') && *p == L('.')) { - ++p; while (1) { c = *++p; - if (c == '\0') + if (c == L('\0')) return FNM_NOMATCH; - if (*p == L('.') && p[1] == L(']')) + if (c == L('.') && p[1] == L(']')) break; } p += 2; diff --git a/posix/tst-fnmatch3.c b/posix/tst-fnmatch3.c index d27a557c7c..75bc00a2c5 100644 --- a/posix/tst-fnmatch3.c +++ b/posix/tst-fnmatch3.c @@ -21,9 +21,11 @@ int do_test (void) { - const char *pattern = "[[:alpha:]'[:alpha:]\0]"; - - return fnmatch (pattern, "a", 0) != FNM_NOMATCH; + if (fnmatch ("[[:alpha:]'[:alpha:]\0]", "a", 0) != FNM_NOMATCH) + return 1; + if (fnmatch ("[a[.\0.]]", "a", 0) != FNM_NOMATCH) + return 1; + return 0; } #define TEST_FUNCTION do_test () -- cgit 1.4.1