[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260805075723.3520270-1-matthias.goergens@gmail.com>
Date: Wed, 5 Aug 2026 15:57:23 +0800
From: Matthias Goergens <matthias.goergens@...il.com>
To: musl@...ts.openwall.com
Cc: Matthias Goergens <matthias.goergens@...il.com>
Subject: [PATCH] regex: avoid overflow sizing glob result vector
GLOB_DOOFFS makes gl_offs part of the caller-controlled result-vector
size. Unchecked allocation arithmetic can wrap to a small buffer, then
out-of-bounds pointer writes follow. GLOB_APPEND has the same issue.
Validate the complete pointer count, including its terminating null,
before either allocation. This also makes later indices and the count
update safe while preserving an existing result on append failure.
---
src/regex/glob.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/regex/glob.c b/src/regex/glob.c
index 87bae084..149d7935 100644
--- a/src/regex/glob.c
+++ b/src/regex/glob.c
@@ -10,6 +10,7 @@
#include <stddef.h>
#include <unistd.h>
#include <pwd.h>
+#include <stdint.h>
struct match
{
@@ -269,6 +270,13 @@ int glob(const char *restrict pat, int flags, int (*errfunc)(const char *path, i
return GLOB_NOMATCH;
}
+ size_t max = SIZE_MAX / sizeof(char *);
+ if (offs > max || g->gl_pathc > max-offs
+ || cnt >= max-offs-g->gl_pathc) {
+ freelist(&head);
+ return GLOB_NOSPACE;
+ }
+
if (flags & GLOB_APPEND) {
char **pathv = realloc(g->gl_pathv, (offs + g->gl_pathc + cnt + 1) * sizeof(char *));
if (!pathv) {
--
2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
