[Bug glob/26620] New: fnmatch with collating symbols results in segmentation fault

[Bug glob/26620] New: fnmatch with collating symbols results in segmentation fault

[harald at gigawatt dot nl]

https://sourceware.org/bugzilla/show_bug.cgi?id=26620

            Bug ID: 26620
           Summary: fnmatch with collating symbols results in segmentation
                    fault
           Product: glibc
           Version: 2.32
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: glob
          Assignee: unassigned at sourceware dot org
          Reporter: harald at gigawatt dot nl
  Target Milestone: ---

Consider this test program:

  #include <stdio.h>
  #include <locale.h>
  #include <fnmatch.h>
  int main(int argc, char *argv[]) {
    setlocale(LC_ALL, "");
    if (argc != 3) {
      fprintf(stderr, "usage: fnmatch <pattern> <string>\n");
      return 2;
    }
    return !!fnmatch(argv[1], argv[2], 0);
  }

When called as

  export LC_ALL=en_US.UTF-8
  ./fnmatch $'[[.L\u00B7.]]' . # [[.L·.]]

This results in a segmentation fault in internal_fnwmatch.

Seen on glibc 2.32 built with GCC 10.2.0, also reproducible with the
libc6-2.31-0ubuntu9 provided by Ubuntu 20.04 for amd64.

(I think there are a few more bugs in there that do not result in a crash, but
do result in a wrong return value. Should I include the details in here or
report that separately?)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug glob/26620] fnmatch with collating symbols results in segmentation fault

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26620

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |2.33
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
Fixed in 2.33.  For further bugs please open separate reports.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug glob/26620] fnmatch with collating symbols results in segmentation fault

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26620

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
Marking as security- because this needs a crafted pattern.

-- 
You are receiving this mail because:
You are on the CC list for the bug.