diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2011-01-12 01:53:15 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2011-01-12 01:53:15 +0000 |
| commit | fa37b8588ff84cf74828eb4c07104c12ea624f4e (patch) | |
| tree | e2d9c1d81599bb9a5687021112008cf2f3353819 /lib | |
| parent | 79a0bcf547eb705c9911db007b7f8c526d054567 (diff) | |
avoid some integer overflows mostly with GLOB_APPEND and GLOB_DOOFFS
and sanity check arguments (these will be unnecessary when we switch
struct glob members from being type into to size_t in the future);
"looks ok" tedu@ feedback guenther@
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libc/gen/glob.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/lib/libc/gen/glob.c b/lib/libc/gen/glob.c index ff1a3dd3807..14fa957d539 100644 --- a/lib/libc/gen/glob.c +++ b/lib/libc/gen/glob.c @@ -1,4 +1,4 @@ -/* $OpenBSD: glob.c,v 1.34 2010/10/08 21:48:42 nicm Exp $ */ +/* $OpenBSD: glob.c,v 1.35 2011/01/12 01:53:14 djm Exp $ */ /* * Copyright (c) 1989, 1993 * The Regents of the University of California. All rights reserved. @@ -177,6 +177,11 @@ glob(const char *pattern, int flags, int (*errfunc)(const char *, int), pglob->gl_errfunc = errfunc; pglob->gl_matchc = 0; + if (pglob->gl_offs < 0 || pglob->gl_pathc < 0 || + pglob->gl_offs >= INT_MAX || pglob->gl_pathc >= INT_MAX || + pglob->gl_pathc >= INT_MAX - pglob->gl_offs - 1) + return GLOB_NOSPACE; + bufnext = patbuf; bufend = bufnext + MAXPATHLEN - 1; if (flags & GLOB_NOESCAPE) @@ -742,10 +747,13 @@ globextend(const Char *path, glob_t *pglob, struct glob_lim *limitp, struct stat **statv; newn = 2 + pglob->gl_pathc + pglob->gl_offs; - if (SIZE_MAX / sizeof(*pathv) <= newn || + if (pglob->gl_offs >= INT_MAX || + pglob->gl_pathc >= INT_MAX || + newn >= INT_MAX || + SIZE_MAX / sizeof(*pathv) <= newn || SIZE_MAX / sizeof(*statv) <= newn) { nospace: - for (i = pglob->gl_offs; i < newn - 2; i++) { + for (i = pglob->gl_offs; i < (ssize_t)(newn - 2); i++) { if (pglob->gl_pathv && pglob->gl_pathv[i]) free(pglob->gl_pathv[i]); if ((pglob->gl_flags & GLOB_KEEPSTAT) != 0 && @@ -860,7 +868,7 @@ match(Char *name, Char *pat, Char *patend) ++pat; while (((c = *pat++) & M_MASK) != M_END) { if ((c & M_MASK) == M_CLASS) { - int idx = *pat & M_MASK; + Char idx = *pat & M_MASK; if (idx < NCCLASSES && cclasses[idx].isctype(k)) ok = 1; |