[Bug glob/31075] fnmatch("??") matches on one two byte valid character (as well as two any-length characters)

["stephane+sourceware at chazelas dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=31075

Stephane Chazelas <stephane+sourceware at chazelas dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|fnmatch("??") matches on    |fnmatch("??") matches on
                   |2-byte single characters    |one two byte valid
                   |(as well as 2 any-length    |character (as well as two
                   |characters)                 |any-length characters)
              Flags|                            |security?

--- Comment #2 from Stephane Chazelas <stephane+sourceware at chazelas dot org> ---
Can likely be considered a security issue as that means patterns match things
that where not intended be matched (I'll let you guys decide on that), but on
the other hand that bug works around long-standing issues whereby for instance

find . ! -name '*evil*' -exec ... {} +

was failing to exclude file names containing "evil" when what's on either side
is not valid text in the users locale (a common issue these days where UTF-8 is
the norm).

Though of course falling back to treating both pattern and subject as char[]
arrays when the subject cannot be decoded as text like bash does (and what
might have been the intent of a79328c745219dcb395070cdcd3be065a8347f24) is
incorrect (see
https://lists.gnu.org/archive/html/bug-bash/2021-02/msg00054.html for more
details).

-- 
You are receiving this mail because:
You are on the CC list for the bug.