[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260805134749.767161-1-matthias.goergens@gmail.com>
Date: Wed, 5 Aug 2026 21:47:48 +0800
From: Matthias Goergens <matthias.goergens@...il.com>
To: musl@...ts.openwall.com
Cc: nsz@...t70.net,
Matthias Goergens <matthias.goergens@...il.com>
Subject: [PATCH v2] regex: avoid overflow sizing glob result vector
GLOB_DOOFFS makes gl_offs part of the caller-controlled result-vector
size. Unchecked allocation arithmetic can wrap to a small buffer, then
out-of-bounds pointer writes follow. GLOB_APPEND has the same issue.
Validate the complete pointer count, including its terminating null,
before either allocation. This also makes later indices and the count
update safe while preserving an existing result on append failure.
---
v2: simplified the overflow check per Szabolcs Nagy's suggestion;
kept the explicit guard for caller-controlled gl_offs.
src/regex/glob.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/src/regex/glob.c b/src/regex/glob.c
index 87bae084..6488ebfe 100644
--- a/src/regex/glob.c
+++ b/src/regex/glob.c
@@ -269,8 +269,19 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i
return GLOB_NOMATCH;
}
+ /* offs is caller-controlled with GLOB_DOOFFS, so it needs an
+ * explicit guard. gl_pathc was bounded by this same check on the
+ * call that produced it, and cnt live match allocations cannot
+ * reach lim, so the sum below cannot wrap. */
+ size_t lim = -1/sizeof(char *)/2;
+ size_t n = offs + g->gl_pathc + cnt + 1;
+ if (offs >= lim || n > lim) {
+ freelist(&head);
+ return GLOB_NOSPACE;
+ }
+
if (flags & GLOB_APPEND) {
- char **pathv = realloc(g->gl_pathv, (offs + g->gl_pathc + cnt + 1) * sizeof(char *));
+ char **pathv = realloc(g->gl_pathv, n * sizeof(char *));
if (!pathv) {
freelist(&head);
return GLOB_NOSPACE;
@@ -278,7 +289,7 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i
g->gl_pathv = pathv;
offs += g->gl_pathc;
} else {
- g->gl_pathv = malloc((offs + cnt + 1) * sizeof(char *));
+ g->gl_pathv = malloc(n * sizeof(char *));
if (!g->gl_pathv) {
freelist(&head);
return GLOB_NOSPACE;
--
2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
