bug-bash
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Patch] Crash on forbidden subdirectories with globstar shell option


From: werner
Subject: [Patch] Crash on forbidden subdirectories with globstar shell option
Date: Tue, 21 Apr 2009 13:00:48 +0200

Configuration Information [Automatically generated, do not change]:
Machine: i586
OS: linux-gnu
Compiler: gcc -I/usr/src/packages/BUILD/bash-4.0 
-L/usr/src/packages/BUILD/bash-4.0/../readline-6.0
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i586' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i586-suse-linux-gnu' 
-DCONF_VENDOR='suse' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL 
-DHAVE_CONFIG_H   -I.  -I. -I./include -I./lib   -O2 -march=i586 -mtune=i686 
-fmessage-length=0 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables 
-fasynchronous-unwind-tables -g -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 
-D_GNU_SOURCE -DRECYCLES_PIDS -Wall -g -std=gnu89 -Wextra 
-Wno-unprototyped-calls -Wno-switch-enum -Wno-unused-variable 
-Wno-unused-parameter -ftree-loop-linear -pipe -fprofile-use
uname output: Linux boole 2.6.27.19-3.2-pae #1 SMP 2009-02-25 15:40:44 +0100 
i686 i686 i386 GNU/Linux
Machine Type: i586-suse-linux-gnu

Bash Version: 4.0
Patch Level: 17
Release Status: release

Description:
        Found a crash due free'ing invalid pointer caused by enabled globstar
        shell option and a subdirectory which are forbidden.  In my case the
        crash was caused by /etc/X11/xdm/authdir

Repeat-By:
        shopt -s globstar
        ls /etc/**

Fix:
--- lib/glob/glob.c
+++ lib/glob/glob.c     2009-04-21 10:51:48.478986919 +0000
@@ -96,7 +96,7 @@ int noglob_dot_filenames = 1;
 int glob_ignore_case = 0;
 
 /* Global variable to return to signify an error in globbing. */
-char *glob_error_return;
+char *glob_error_return = (char *)NULL;
 
 static struct globval finddirs_error_return;
 
@@ -356,7 +356,7 @@ finddirs (pat, sdir, flags, ep, np)
        *np = 0;
       if (ep)
         *ep = 0;
-      if (r)
+      if (r && r != (char **)&glob_error_return)
        free (r);
       return (struct globval *)0;
     }




reply via email to

[Prev in Thread] Current Thread [Next in Thread]