From b3a9f56ba59c3d8eadd3135a1c25c37a63151450 Mon Sep 17 00:00:00 2001 From: Andreas Schwab Date: Wed, 18 Jun 2014 11:58:45 +0200 Subject: Don't read past end of pattern in fnmatch (BZ #17062) --- posix/fnmatch_loop.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) (limited to 'posix/fnmatch_loop.c') diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c index f79d051a3a..544769b4f6 100644 --- a/posix/fnmatch_loop.c +++ b/posix/fnmatch_loop.c @@ -899,11 +899,8 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used) matched: /* Skip the rest of the [...] that already matched. */ - do + while ((c = *p++) != L (']')) { - ignore_next: - c = *p++; - if (c == L('\0')) /* [... (unterminated) loses. */ return FNM_NOMATCH; @@ -931,12 +928,11 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used) if (c < L('a') || c >= L('z')) { - p = startp; - goto ignore_next; + p = startp - 2; + break; } } p += 2; - c = *p++; } else if (c == L('[') && *p == L('=')) { @@ -947,7 +943,6 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used) if (c != L('=') || p[1] != L(']')) return FNM_NOMATCH; p += 2; - c = *p++; } else if (c == L('[') && *p == L('.')) { @@ -962,10 +957,8 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used) break; } p += 2; - c = *p++; } } - while (c != L(']')); if (not) return FNM_NOMATCH; } -- cgit 1.4.1