-
Notifications
You must be signed in to change notification settings - Fork 706
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Backported the original patch to 2.26 version. https://sourceware.org/git/?p=glibc.git;a=patch;h=ddc650e9b3dc916eab417ce9f79e67337b05035c;hp=f2323817dde1e87d44e058af5954c25d72fbdb11 Change-Id: I05b625bc21e55f5cb0feb286ce54684301d31e75 Signed-off-by: Keerthana K <keerthanak@vmware.com> Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/10120 Tested-by: gerrit-photon <photon-checkins@vmware.com> Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
- Loading branch information
1 parent
727188a
commit 285fba4
Showing
2 changed files
with
66 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| From ddc650e9b3dc916eab417ce9f79e67337b05035c Mon Sep 17 00:00:00 2001 | ||
| From: Andreas Schwab <schwab@suse.de> | ||
| Date: Wed, 19 Feb 2020 17:21:46 +0100 | ||
| Subject: [PATCH 1/1] Fix use-after-free in glob when expanding ~user (bug | ||
| 25414) | ||
|
|
||
| The value of `end_name' points into the value of `dirname', thus don't | ||
| deallocate the latter before the last use of the former. | ||
|
|
||
| Signed-off-by: Keerthana K <keerthanak@vmware.com> | ||
| --- | ||
| posix/glob.c | 25 +++++++++++++------------ | ||
| 1 file changed, 13 insertions(+), 12 deletions(-) | ||
|
|
||
|
|
||
| diff --git a/posix/glob.c b/posix/glob.c | ||
| index 6db26c8..f23ac6e 100644 | ||
| --- a/posix/glob.c | ||
| +++ b/posix/glob.c | ||
| @@ -946,28 +946,30 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int), | ||
| { | ||
| size_t home_len = strlen (p->pw_dir); | ||
| size_t rest_len = end_name == NULL ? 0 : strlen (end_name); | ||
| + char *newp; | ||
| + bool use_alloca = glob_use_alloca (alloca_used, | ||
| + home_len + rest_len + 1); | ||
|
|
||
| - if (__glibc_unlikely (malloc_dirname)) | ||
| - free (dirname); | ||
| - malloc_dirname = 0; | ||
| - | ||
| - if (glob_use_alloca (alloca_used, home_len + rest_len + 1)) | ||
| - dirname = alloca_account (home_len + rest_len + 1, | ||
| - alloca_used); | ||
| + if (use_alloca) | ||
| + newp = alloca_account (home_len + rest_len + 1, alloca_used); | ||
| else | ||
| { | ||
| - dirname = malloc (home_len + rest_len + 1); | ||
| - if (dirname == NULL) | ||
| + newp = malloc (home_len + rest_len + 1); | ||
| + if (newp == NULL) | ||
| { | ||
| free (malloc_pwtmpbuf); | ||
| retval = GLOB_NOSPACE; | ||
| goto out; | ||
| } | ||
| - malloc_dirname = 1; | ||
| } | ||
| - *((char *) mempcpy (mempcpy (dirname, p->pw_dir, home_len), | ||
| + *((char *) mempcpy (mempcpy (newp, p->pw_dir, home_len), | ||
| end_name, rest_len)) = '\0'; | ||
|
|
||
| + if (__glibc_unlikely (malloc_dirname)) | ||
| + free (dirname); | ||
| + dirname = newp; | ||
| + malloc_dirname = !use_alloca; | ||
| + | ||
| dirlen = home_len + rest_len; | ||
| dirname_modified = 1; | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters