diff options
| author | Rich Felker <dalias@aerifal.cx> | 2017-01-02 19:47:12 -0500 |
|---|---|---|
| committer | Rich Felker <dalias@aerifal.cx> | 2017-01-02 19:47:12 -0500 |
| commit | 769f53598e781ffc89191520f3f8a93cb58db91f (patch) | |
| tree | 47c26bac9a6a34937f8afe15bbed32140c3bed6f /src/regex | |
| parent | 61fb81e3959ecf0848eef8d2767bb80ae5d1a68e (diff) | |
| download | musl-769f53598e781ffc89191520f3f8a93cb58db91f.tar.gz musl-769f53598e781ffc89191520f3f8a93cb58db91f.tar.xz musl-769f53598e781ffc89191520f3f8a93cb58db91f.zip | |
make globfree safe after failed glob from over-length argument
commit 0dc99ac413d8bc054a2e95578475c7122455eee8 added input length checking to avoid unsafe VLA allocation, but put it in the wrong place, before the glob_t structure was zeroed out. while POSIX isn't clear on whether it's permitted to call globfree after glob failed with GLOB_NOSPACE, making it safe is clearly better than letting uninitialized pointers get passed to free in non-conforming callers. while we're fixing this, change strlen check to the idiomatic strnlen version to avoid unbounded input scanning before returning an error.
Diffstat (limited to 'src/regex')
| -rw-r--r-- | src/regex/glob.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/regex/glob.c b/src/regex/glob.c index 6affee04..5b6ff124 100644 --- a/src/regex/glob.c +++ b/src/regex/glob.c @@ -169,8 +169,6 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i d = ""; } - if (strlen(p) > PATH_MAX) return GLOB_NOSPACE; - if (!errfunc) errfunc = ignore_err; if (!(flags & GLOB_APPEND)) { @@ -179,6 +177,8 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i g->gl_pathv = NULL; } + if (strnlen(p, PATH_MAX+1) > PATH_MAX) return GLOB_NOSPACE; + if (*p) error = match_in_dir(d, p, flags, errfunc, &tail); if (error == GLOB_NOSPACE) { freelist(&head); |