From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 8136 invoked by alias); 25 Feb 2016 19:07:43 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 8121 invoked by uid 89); 25 Feb 2016 19:07:42 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.99 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=-0.7 required=5.0 tests=AWL,BAYES_00,KAM_LAZY_DOMAIN_SECURITY autolearn=no version=3.3.2 spammy=fct, FCT, cherry, news X-Spam-Status: No, score=-0.7 required=5.0 tests=AWL,BAYES_00,KAM_LAZY_DOMAIN_SECURITY autolearn=no version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: e24smtp03.br.ibm.com X-IBM-Helo: d24dlp01.br.ibm.com X-IBM-MailFrom: tuliom@linux.vnet.ibm.com X-IBM-RcptTo: libc-stable@sourceware.org From: "Tulio Magno Quites Machado Filho" To: libc-stable@sourceware.org Cc: Andreas Schwab Subject: [COMMITTED 2.20] Fix read past end of pattern in fnmatch (bug 18032) Date: Fri, 01 Jan 2016 00:00:00 -0000 Message-Id: <1456427204-1730-4-git-send-email-tuliom@linux.vnet.ibm.com> X-Mailer: git-send-email 2.1.0 In-Reply-To: <1456427204-1730-1-git-send-email-tuliom@linux.vnet.ibm.com> References: <1456427204-1730-1-git-send-email-tuliom@linux.vnet.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16022519-0025-0000-0000-00000621AAAA X-SW-Source: 2016-02/txt/msg00014.txt.bz2 From: Andreas Schwab (cherry picked from commit 4a28f4d55a6cc33474c0792fe93b5942d81bf185) Conflicts: NEWS --- ChangeLog | 7 +++++++ NEWS | 2 +- posix/fnmatch_loop.c | 5 ++--- posix/tst-fnmatch3.c | 8 +++++--- 4 files changed, 15 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index a4917cd..4a45f60 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2016-02-25 Andreas Schwab + + [BZ #18032] + * posix/fnmatch_loop.c (FCT): Remove extra increment when skipping + over collating symbol inside a bracket expression. Minor cleanup. + * posix/tst-fnmatch3.c (do_test): Add test case. + 2016-02-25 Paul Pluzhnikov [BZ #17269] diff --git a/NEWS b/NEWS index 57a7f11..9392e32 100644 --- a/NEWS +++ b/NEWS @@ -10,7 +10,7 @@ Version 2.20.1 * The following bugs are resolved with this release: 16009, 16617, 16618, 17266, 17269, 17370, 17371, 17460, 17485, 17555, - 17625, 17630, 17801, 18694, 18928, 19018. + 17625, 17630, 17801, 18032, 18694, 18928, 19018. * The LD_POINTER_GUARD environment variable can no longer be used to disable the pointer guard feature. It is always enabled. diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c index db6d9d7..f09b7ce 100644 --- a/posix/fnmatch_loop.c +++ b/posix/fnmatch_loop.c @@ -940,14 +940,13 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used) } else if (c == L('[') && *p == L('.')) { - ++p; while (1) { c = *++p; - if (c == '\0') + if (c == L('\0')) return FNM_NOMATCH; - if (*p == L('.') && p[1] == L(']')) + if (c == L('.') && p[1] == L(']')) break; } p += 2; diff --git a/posix/tst-fnmatch3.c b/posix/tst-fnmatch3.c index 2a83c1b..e03e478 100644 --- a/posix/tst-fnmatch3.c +++ b/posix/tst-fnmatch3.c @@ -21,9 +21,11 @@ int do_test (void) { - const char *pattern = "[[:alpha:]'[:alpha:]\0]"; - - return fnmatch (pattern, "a", 0) != FNM_NOMATCH; + if (fnmatch ("[[:alpha:]'[:alpha:]\0]", "a", 0) != FNM_NOMATCH) + return 1; + if (fnmatch ("[a[.\0.]]", "a", 0) != FNM_NOMATCH) + return 1; + return 0; } #define TEST_FUNCTION do_test () -- 2.1.0