Fix read past end of pattern in fnmatch (bug 18032)

(cherry picked from commit 4a28f4d55a6cc33474c0792fe93b5942d81bf185)

Conflicts:
	NEWS
	posix/tst-fnmatch3.c

diff --git a/ChangeLog b/ChangeLog
index 14d95f87a82a87aa6d52ab251b87e0a6816791fd..79a59d59cd787b6b0b4c269b8879ca902a859f8e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-12-30  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #18032]
+       * posix/fnmatch_loop.c (FCT): Remove extra increment when skipping
+       over collating symbol inside a bracket expression.  Minor cleanup.
+       * posix/tst-fnmatch3.c (do_test): Add test case.
+
 2015-12-30  Florian Weimer  <fweimer@redhat.com>
 
        [BZ #19018]

diff --git a/NEWS b/NEWS
index 52e77ee3940f0f37be6d0fda740512efc8b07c6b..3ae421139dd578ab6c360b8701886ccda6d39eea 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,7 +10,7 @@ Version 2.18.1
 * The following bugs are resolved with this release:
 
   15073, 15128, 15909, 15996, 16150, 16169, 16387, 16510, 16885, 16916,
-  16943, 16958, 18928, 19018.
+  16943, 16958, 18032, 18928, 19018.
 
 * The LD_POINTER_GUARD environment variable can no longer be used to
   disable the pointer guard feature.  It is always enabled.

diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c
index 078b98242e800c1a8d2fbef88fc49b189dd4b093..5002ccbce15098d7977d85aeb96d34e4a928c941 100644 (file)
--- a/posix/fnmatch_loop.c
+++ b/posix/fnmatch_loop.c
@@ -951,14 +951,13 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
                  }
                else if (c == L('[') && *p == L('.'))
                  {
-                   ++p;
                    while (1)
                      {
                        c = *++p;
-                       if (c == '\0')
+                       if (c == L('\0'))
                          return FNM_NOMATCH;
 
-                       if (*p == L('.') && p[1] == L(']'))
+                       if (c == L('.') && p[1] == L(']'))
                          break;
                      }
                    p += 2;

diff --git a/posix/tst-fnmatch3.c b/posix/tst-fnmatch3.c
new file mode 100644 (file)
index 0000000..75bc00a
--- /dev/null
+++ b/posix/tst-fnmatch3.c
@@ -0,0 +1,32 @@
+/* Test for fnmatch not reading past the end of the pattern.
+   Copyright (C) 2014-2015 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <fnmatch.h>
+
+int
+do_test (void)
+{
+  if (fnmatch ("[[:alpha:]'[:alpha:]\0]", "a", 0) != FNM_NOMATCH)
+    return 1;
+  if (fnmatch ("[a[.\0.]]", "a", 0) != FNM_NOMATCH)
+    return 1;
+  return 0;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"