public inbox for libc-stable@sourceware.org
 help / color / mirror / Atom feed
From: Aurelien Jarno <aurelien@aurel32.net>
To: libc-stable@sourceware.org
Cc: Florian Weimer <fweimer@redhat.com>
Subject: [COMMITTED 2.25 7/8] posix/tst-glob-tilde.c: Add test for bug 22332
Date: Sun, 01 Jan 2017 00:00:00 -0000	[thread overview]
Message-ID: <20171202095206.9955-7-aurelien@aurel32.net> (raw)
In-Reply-To: <20171202095206.9955-1-aurelien@aurel32.net>

From: Florian Weimer <fweimer@redhat.com>

(cherry picked from commit 2fac6a6cd50c22ac28c97d0864306594807ade3e)
---
 ChangeLog              |  7 +++++++
 posix/tst-glob-tilde.c | 53 ++++++++++++++++++++++++++++----------------------
 2 files changed, 37 insertions(+), 23 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 951fe6f882..f85bf022b9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2017-11-02  Florian Weimer  <fweimer@redhat.com>
+
+	[BZ #22332]
+	* posix/tst-glob-tilde.c (do_noescape): New variable.
+	(one_test): Process it.
+	(do_test): Set do_noescape.  Add unescaping test case.
+
 2017-10-22  Paul Eggert <eggert@cs.ucla.edu>
 
 	[BZ #22332]
diff --git a/posix/tst-glob-tilde.c b/posix/tst-glob-tilde.c
index 9518b4a6f8..6886f4371f 100644
--- a/posix/tst-glob-tilde.c
+++ b/posix/tst-glob-tilde.c
@@ -1,4 +1,4 @@
-/* Check for GLOB_TIDLE heap allocation issues (bug 22320, bug 22325).
+/* Check for GLOB_TIDLE heap allocation issues (bugs 22320, 22325, 22332).
    Copyright (C) 2017 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
@@ -34,6 +34,9 @@ static int do_nocheck;
 /* Flag which indicates whether to pass the GLOB_MARK flag.  */
 static int do_mark;
 
+/* Flag which indicates whether to pass the GLOB_NOESCAPE flag.  */
+static int do_noescape;
+
 static void
 one_test (const char *prefix, const char *middle, const char *suffix)
 {
@@ -45,6 +48,8 @@ one_test (const char *prefix, const char *middle, const char *suffix)
     flags |= GLOB_NOCHECK;
   if (do_mark)
     flags |= GLOB_MARK;
+  if (do_noescape)
+    flags |= GLOB_NOESCAPE;
   glob_t gl;
   /* This glob call might result in crashes or memory leaks.  */
   if (glob (pattern, flags, NULL, &gl) == 0)
@@ -105,28 +110,30 @@ do_test (void)
   for (do_onlydir = 0; do_onlydir < 2; ++do_onlydir)
     for (do_nocheck = 0; do_nocheck < 2; ++do_nocheck)
       for (do_mark = 0; do_mark < 2; ++do_mark)
-        for (int base_idx = 0; base_sizes[base_idx] >= 0; ++base_idx)
-          {
-            for (int size_skew = -max_size_skew; size_skew <= max_size_skew;
-                 ++size_skew)
-              {
-                int size = base_sizes[base_idx] + size_skew;
-                if (size < 0)
-                  continue;
-
-                const char *user_name = repeating_string (size);
-                one_test ("~", user_name, "/a/b");
-              }
-
-            const char *user_name = repeating_string (base_sizes[base_idx]);
-            one_test ("~", user_name, "");
-            one_test ("~", user_name, "/");
-            one_test ("~", user_name, "/a");
-            one_test ("~", user_name, "/*/*");
-            one_test ("~", user_name, "\\/");
-            one_test ("/~", user_name, "");
-            one_test ("*/~", user_name, "/a/b");
-          }
+	for (do_noescape = 0; do_noescape < 2; ++do_noescape)
+	  for (int base_idx = 0; base_sizes[base_idx] >= 0; ++base_idx)
+	    {
+	      for (int size_skew = -max_size_skew; size_skew <= max_size_skew;
+		   ++size_skew)
+		{
+		  int size = base_sizes[base_idx] + size_skew;
+		  if (size < 0)
+		    continue;
+
+		  const char *user_name = repeating_string (size);
+		  one_test ("~", user_name, "/a/b");
+		  one_test ("~", user_name, "x\\x\\x////x\\a");
+		}
+
+	      const char *user_name = repeating_string (base_sizes[base_idx]);
+	      one_test ("~", user_name, "");
+	      one_test ("~", user_name, "/");
+	      one_test ("~", user_name, "/a");
+	      one_test ("~", user_name, "/*/*");
+	      one_test ("~", user_name, "\\/");
+	      one_test ("/~", user_name, "");
+	      one_test ("*/~", user_name, "/a/b");
+	    }
 
   free (repeat);
 
-- 
2.15.0

  parent reply	other threads:[~2017-12-02  9:52 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-01-01  0:00 [COMMITTED 2.25 1/8] i386: Hide __old_glob64 [BZ #18822] Aurelien Jarno
2017-01-01  0:00 ` [COMMITTED 2.25 6/8] glob: Fix buffer overflow during GLOB_TILDE unescaping [BZ #22332] Aurelien Jarno
2017-01-01  0:00 ` [COMMITTED 2.25 3/8] CVE-2017-15670: glob: Fix one-byte overflow [BZ #22320] Aurelien Jarno
2017-01-01  0:00   ` Dmitry V. Levin
2017-01-01  0:00     ` Aurelien Jarno
2017-01-01  0:00 ` [COMMITTED 2.25 2/8] posix: Sync glob with gnulib [BZ #1062] Aurelien Jarno
2017-01-01  0:00 ` [COMMITTED 2.25 5/8] Update NEWS and ChangeLog for CVE-2017-15671 Aurelien Jarno
2017-01-01  0:00 ` [COMMITTED 2.25 8/8] Update NEWS to add CVE-2017-15804 entry Aurelien Jarno
2017-01-01  0:00 ` Aurelien Jarno [this message]
2017-01-01  0:00 ` [COMMITTED 2.25 4/8] glob: Add new test tst-glob-tilde Aurelien Jarno

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171202095206.9955-7-aurelien@aurel32.net \
    --to=aurelien@aurel32.net \
    --cc=fweimer@redhat.com \
    --cc=libc-stable@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).