Fix read past end of pattern in fnmatch (bug 18032)

(cherry picked from commit 4a28f4d55a6cc33474c0792fe93b5942d81bf185)

diff --git a/ChangeLog b/ChangeLog
index 76d3e9684409a9e01f9c817fbc6fed3e4dcc204a..928b2267087e511e1ef1e830047fc9e187028391 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-02-26  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #18032]
+       * posix/fnmatch_loop.c (FCT): Remove extra increment when skipping
+       over collating symbol inside a bracket expression.  Minor cleanup.
+       * posix/tst-fnmatch3.c (do_test): Add test case.
+
 2015-07-21  Mike Frysinger  <vapier@gentoo.org>
 
        [BZ #18694]

diff --git a/NEWS b/NEWS
index f9b359a5b7f4f1acc7350f3396efc5450e50ded9..09fddab41d778cee8d33f7cf6b0abd2724f9bf45 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,7 @@ Version 2.21.1
 
 * The following bugs are resolved with this release:
 
-  17949, 18287, 18694.
+  17949, 18032, 18287, 18694.
 
 * A buffer overflow in gethostbyname_r and related functions performing DNS
   requests has been fixed.  If the NSS functions were called with a

diff --git a/posix/fnmatch_loop.c b/posix/fnmatch_loop.c
index c0cb2fc3e6cd5280043207d40a1d8f119ca5d3cf..72c5d8f0413379b0027e9ec6d11ab9c706d6b6ac 100644 (file)
--- a/posix/fnmatch_loop.c
+++ b/posix/fnmatch_loop.c
@@ -945,14 +945,13 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
                  }
                else if (c == L('[') && *p == L('.'))
                  {
-                   ++p;
                    while (1)
                      {
                        c = *++p;
-                       if (c == '\0')
+                       if (c == L('\0'))
                          return FNM_NOMATCH;
 
-                       if (*p == L('.') && p[1] == L(']'))
+                       if (c == L('.') && p[1] == L(']'))
                          break;
                      }
                    p += 2;

diff --git a/posix/tst-fnmatch3.c b/posix/tst-fnmatch3.c
index d27a557c7cb1d46f02aa09fa900acdf38a32f9f8..75bc00a2c56669b2cc9a1e6f85557513e6685f50 100644 (file)
--- a/posix/tst-fnmatch3.c
+++ b/posix/tst-fnmatch3.c
@@ -21,9 +21,11 @@
 int
 do_test (void)
 {
-  const char *pattern = "[[:alpha:]'[:alpha:]\0]";
-
-  return fnmatch (pattern, "a", 0) != FNM_NOMATCH;
+  if (fnmatch ("[[:alpha:]'[:alpha:]\0]", "a", 0) != FNM_NOMATCH)
+    return 1;
+  if (fnmatch ("[a[.\0.]]", "a", 0) != FNM_NOMATCH)
+    return 1;
+  return 0;
 }
 
 #define TEST_FUNCTION do_test ()