[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260805113742.GK3520958@port70.net>
Date: Wed, 5 Aug 2026 13:37:42 +0200
From: Szabolcs Nagy <nsz@...t70.net>
To: Matthias Goergens <matthias.goergens@...il.com>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH] regex: avoid overflow sizing glob result vector
* Matthias Goergens <matthias.goergens@...il.com> [2026-08-05 15:57:23 +0800]:
> GLOB_DOOFFS makes gl_offs part of the caller-controlled result-vector
> size. Unchecked allocation arithmetic can wrap to a small buffer, then
> out-of-bounds pointer writes follow. GLOB_APPEND has the same issue.
>
> Validate the complete pointer count, including its terminating null,
> before either allocation. This also makes later indices and the count
> update safe while preserving an existing result on append failure.
> ---
> src/regex/glob.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/src/regex/glob.c b/src/regex/glob.c
> index 87bae084..149d7935 100644
> --- a/src/regex/glob.c
> +++ b/src/regex/glob.c
> @@ -10,6 +10,7 @@
> #include <stddef.h>
> #include <unistd.h>
> #include <pwd.h>
> +#include <stdint.h>
>
> struct match
> {
> @@ -269,6 +270,13 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i
> return GLOB_NOMATCH;
> }
>
> + size_t max = SIZE_MAX / sizeof(char *);
> + if (offs > max || g->gl_pathc > max-offs
> + || cnt >= max-offs-g->gl_pathc) {
> + freelist(&head);
> + return GLOB_NOSPACE;
> + }
> +
looks ok.
but we can assume offs < lim && g->gl_pathc < lim && cnt < lim
with lim == -1/sizeof(char*)/2 and then (if sizeof(char*)>1)
it is enough to check
size_t n = offs + g->gl_pathc + cnt + 1;
if (n > -1/sizeof(char*)/2) {
...
> if (flags & GLOB_APPEND) {
> char **pathv = realloc(g->gl_pathv, (offs + g->gl_pathc + cnt + 1) * sizeof(char *));
and change this to ..., n * sizeof(char *)
same in the else branch, so compiler reuses n.
> if (!pathv) {
> --
> 2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
