提交 da0fcdb8 编写于 作者: S Szabolcs Nagy

fix the end of string matching in fnmatch with FNM_PATHNAME

a '/' in the pattern could be incorrectly matched against the
terminating null byte in the string causing arbitrarily long
sequence of out-of-bounds access in fnmatch("/","",FNM_PATHNAME)
上级 7603c5f1
......@@ -288,10 +288,10 @@ int fnmatch(const char *pat, const char *str, int flags)
if (flags & FNM_PATHNAME) for (;;) {
for (s=str; *s && *s!='/'; s++);
for (p=pat; (c=pat_next(p, -1, &inc, flags))!=END && c!='/'; p+=inc);
if (*s && *p!=*s) return FNM_NOMATCH;
if (*p!=*s) return FNM_NOMATCH;
if (fnmatch_internal(pat, p-pat, str, s-str, flags))
return FNM_NOMATCH;
if (!*s && c==END) return 0;
if (!*s) return 0;
str = s+1;
pat = p+1;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册