[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260805140737.GB3542221@port70.net>
Date: Wed, 5 Aug 2026 16:07:37 +0200
From: Szabolcs Nagy <nsz@...t70.net>
To: Matthias Goergens <matthias.goergens@...il.com>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH v2] regex: avoid overflow sizing glob result vector
* Matthias Goergens <matthias.goergens@...il.com> [2026-08-05 21:47:48 +0800]:
> GLOB_DOOFFS makes gl_offs part of the caller-controlled result-vector
> size. Unchecked allocation arithmetic can wrap to a small buffer, then
> out-of-bounds pointer writes follow. GLOB_APPEND has the same issue.
>
> Validate the complete pointer count, including its terminating null,
> before either allocation. This also makes later indices and the count
> update safe while preserving an existing result on append failure.
> ---
> v2: simplified the overflow check per Szabolcs Nagy's suggestion;
> kept the explicit guard for caller-controlled gl_offs.
i thought gl_offs > lim was a user error
fwiw if we must check it i'd do it like
if ((offs|n) > -1/sizeof(char*)/2) ...
> src/regex/glob.c | 15 +++++++++++++--
> 1 file changed, 13 insertions(+), 2 deletions(-)
>
> diff --git a/src/regex/glob.c b/src/regex/glob.c
> index 87bae084..6488ebfe 100644
> --- a/src/regex/glob.c
> +++ b/src/regex/glob.c
> @@ -269,8 +269,19 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i
> return GLOB_NOMATCH;
> }
>
> + /* offs is caller-controlled with GLOB_DOOFFS, so it needs an
> + * explicit guard. gl_pathc was bounded by this same check on the
> + * call that produced it, and cnt live match allocations cannot
> + * reach lim, so the sum below cannot wrap. */
> + size_t lim = -1/sizeof(char *)/2;
> + size_t n = offs + g->gl_pathc + cnt + 1;
> + if (offs >= lim || n > lim) {
> + freelist(&head);
> + return GLOB_NOSPACE;
> + }
> +
> if (flags & GLOB_APPEND) {
> - char **pathv = realloc(g->gl_pathv, (offs + g->gl_pathc + cnt + 1) * sizeof(char *));
> + char **pathv = realloc(g->gl_pathv, n * sizeof(char *));
> if (!pathv) {
> freelist(&head);
> return GLOB_NOSPACE;
> @@ -278,7 +289,7 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i
> g->gl_pathv = pathv;
> offs += g->gl_pathc;
> } else {
> - g->gl_pathv = malloc((offs + cnt + 1) * sizeof(char *));
> + g->gl_pathv = malloc(n * sizeof(char *));
> if (!g->gl_pathv) {
> freelist(&head);
> return GLOB_NOSPACE;
> --
> 2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
