diff options
| author | Szabolcs Nagy <nsz@port70.net> | 2013-12-01 17:32:48 +0000 |
|---|---|---|
| committer | Szabolcs Nagy <nsz@port70.net> | 2013-12-01 17:32:48 +0000 |
| commit | da0fcdb8e913ca7cdf8931328f2b37e93309b2c5 (patch) | |
| tree | 1475f70995478728a6fe41a53cdd20021a3e6878 /src/regex | |
| parent | 7603c5f127316e5ee4c5b161d87742d2ac824567 (diff) | |
| download | musl-da0fcdb8e913ca7cdf8931328f2b37e93309b2c5.tar.gz | |
fix the end of string matching in fnmatch with FNM_PATHNAME
a '/' in the pattern could be incorrectly matched against the
terminating null byte in the string causing arbitrarily long
sequence of out-of-bounds access in fnmatch("/","",FNM_PATHNAME)
Diffstat (limited to 'src/regex')
| -rw-r--r-- | src/regex/fnmatch.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/regex/fnmatch.c b/src/regex/fnmatch.c index ffd3ea0d..c3fcaa5b 100644 --- a/src/regex/fnmatch.c +++ b/src/regex/fnmatch.c @@ -288,10 +288,10 @@ int fnmatch(const char *pat, const char *str, int flags) if (flags & FNM_PATHNAME) for (;;) { for (s=str; *s && *s!='/'; s++); for (p=pat; (c=pat_next(p, -1, &inc, flags))!=END && c!='/'; p+=inc); - if (*s && *p!=*s) return FNM_NOMATCH; + if (*p!=*s) return FNM_NOMATCH; if (fnmatch_internal(pat, p-pat, str, s-str, flags)) return FNM_NOMATCH; - if (!*s && c==END) return 0; + if (!*s) return 0; str = s+1; pat = p+1; } |