diff options
| author | Paul Eggert <eggert@cs.ucla.edu> | 2017-10-19 12:39:45 -0700 |
|---|---|---|
| committer | Paul Eggert <eggert@cs.ucla.edu> | 2017-10-19 12:40:31 -0700 |
| commit | 2d1bd71ec70a31b01d01b734faa66bb1ed28961f (patch) | |
| tree | 42cef7dff9c9ced852f95d27db1f21fed3b7c6e1 /lib/glob.c | |
| parent | 0e14f025d2ad40e9fbe4222e3fda328df107e761 (diff) | |
| download | gnulib-2d1bd71ec70a31b01d01b734faa66bb1ed28961f.tar.gz | |
glob: fix heap buffer overflow
* lib/glob.c (glob): Fix off-by-one error introduced into
glibc in commit dd7d45e838a42b0ed470c44b55901ea98d0c2bab
dated 1997-10-29 20:33:40. Problem reported by Tim Rühsen in:
https://sourceware.org/bugzilla/show_bug.cgi?id=22320
Fix suggested by Bruno Haible.
Diffstat (limited to 'lib/glob.c')
| -rw-r--r-- | lib/glob.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/glob.c b/lib/glob.c index 33030ec72b..67530431e4 100644 --- a/lib/glob.c +++ b/lib/glob.c @@ -764,7 +764,7 @@ glob (const char *pattern, int flags, int (*errfunc) (const char *, int), *p = '\0'; } else - *((char *) mempcpy (newp, dirname + 1, end_name - dirname)) + *((char *) mempcpy (newp, dirname + 1, end_name - dirname - 1)) = '\0'; user_name = newp; } |