| Age | Commit message (Collapse) | Author |
|---|
|
In certain cases, fnmatch() could access the next byte beyond the end of
he passed pattern. A triggering pattern to match is the following
invocation:
fnmatch("[A-Z[.", "F", 0)
The normal A-Z group match gets us to fnmatch_loop.c:421 and then to
fnmatch_loop:599. The F in the filaname matches this expression and
we end up in fnmatch_loop:867 which handles skipping the rest of a
bracked expression that already matched. Here we enter the case where
the next chars to parse are a collating symbol starting with "[."
(fnmatch_loop:918). Currently the p pointer is then advanced by one,
moving it beyond the "." and to the \0 byte of the pattern string
(fnmatch_loop:920). Inside the while loop the pointer is then
incremented again and immediately dereferenced, reaching beyond the
end of the pattern string.
The increment before the while loop must be removed, because only inside
the while loop (after the other increment) a check for the end of the
string is performend. This is sufficient and the check of the end of
the collating symbol is only performed if p[1] is at most the
terminating \0 byte.
Signed-Off-By: Frank Mehnert <frank.mehnert@kernkonzept.com>
|
|
Signed-off-by: Yann Sionneau <ysionneau@kalray.eu>
|
|
Fixes this:
In file included from libc/misc/fnmatch/fnmatch.c:235:0:
libc/misc/fnmatch/fnmatch_loop.c: In function 'internal_fnmatch':
libc/misc/fnmatch/fnmatch_loop.c:207:21: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
CHAR *p_init = p;
^
libc/misc/fnmatch/fnmatch_loop.c:208:21: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
CHAR *n_init = n;
Signed-off-by: Yann Sionneau <ysionneau@kalray.eu>
|
|
Originally fixed in GNU libc by:
commit 794c3ad3a405697e2663b00f616e319383b9bb7d
Author: Ulrich Drepper <drepper@gmail.com>
Date: Fri Jan 14 08:06:22 2011 -0500
Reported-by: Denys Vlasenko <vda.linux@googlemail.com>
via busybox mailinglist.
|
|
This matches a similar change made to glibc.
No functional changes here.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
|
|
Signed-off-by: Peter S. Mazinger <ps.m@gmx.net>
Signed-off-by: Bernhard Reutner-Fischer <rep.dot.nop@gmail.com>
|
|
|
|
missing headers, other jump relocs removed
|
|
UCLIBC_HAS_LOCALE, making the new object about 5k, else it would be 10k
|
