From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date: Fri, 31 Jul 2026 18:06:02 +0000 (+0000)
Subject: posix: Use malloc instead of alloca for the glob brace expansion
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=563f02a6aa0f37fd20ef8c78dc8b4a484a5355fb;p=thirdparty%2Fglibc.git

posix: Use malloc instead of alloca for the glob brace expansion

The last alloca in __glob is the buffer holding one expansion of a
brace expression.  As with the directory and user names, the stack it
takes is not bounded by the call itself.

Use malloc unconditionally.  __glob no longer uses alloca; glob_in_dir
still does, so the accounting stays for now.

Checked on x86_64-linux-gnu, aarch64-linux-gnu, and i686-linux-gnu.

Reviewed-by: Collin Funk <collin.funk1@gmail.com>
---

diff --git a/posix/glob.c b/posix/glob.c
index a3c1f888d5..f1380cf596 100644
--- a/posix/glob.c
+++ b/posix/glob.c
@@ -485,15 +485,10 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
           size_t rest_len;
           char *onealt;
           size_t pattern_len = strlen (pattern) - 1;
-          int alloca_onealt = glob_use_alloca (alloca_used, pattern_len);
-          if (alloca_onealt)
-            onealt = alloca_account (pattern_len, alloca_used);
-          else
-            {
-              onealt = malloc (pattern_len);
-              if (onealt == NULL)
-                return GLOB_NOSPACE;
-            }
+
+          onealt = malloc (pattern_len);
+          if (onealt == NULL)
+            return GLOB_NOSPACE;
 
           /* We know the prefix for all sub-patterns.  */
           alt_start = mempcpy (onealt, pattern, begin - pattern);
@@ -505,8 +500,7 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
             {
               /* It is an invalid expression.  */
             illegal_brace:
-              if (__glibc_unlikely (!alloca_onealt))
-                free (onealt);
+              free (onealt);
               flags &= ~GLOB_BRACE;
               goto no_brace;
             }
@@ -547,8 +541,7 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
               /* If we got an error, return it.  */
               if (result && result != GLOB_NOMATCH)
                 {
-                  if (__glibc_unlikely (!alloca_onealt))
-                    free (onealt);
+                  free (onealt);
                   if (!(flags & GLOB_APPEND))
                     {
                       globfree (pglob);
@@ -566,8 +559,7 @@ __glob (const char *pattern, int flags, int (*errfunc) (const char *, int),
               assert (next != NULL);
             }
 
-          if (__glibc_unlikely (!alloca_onealt))
-            free (onealt);
+          free (onealt);
 
           if (pglob->gl_pathc != firstc)
             /* We found some entries.  */