0000335: potential null pointer access in glob_pattern_p() and extra byte in "/"

(0000279)
vapier
07-11-05 18:43

yeah, glibc had this in their updated glob.c:
        case '\\':
        if (quote && p[1] != '\0')
            ++p;
        break;

so i've committed this

(0000280)
vapier
07-11-05 20:11

glibc uses this:
      qsort ((__ptr_t) &pglob->gl_pathv[oldcount],
         pglob->gl_pathc + pglob->gl_offs - oldcount,

but you use this:
    qsort ((__ptr_t) &pglob->gl_pathv[oldcount + pglob->gl_offs],
      pglob->gl_pathc - oldcount - pglob->gl_offs,

(0000282)
wmq
07-12-05 10:28

I changed the qsort call long time ago, so I don't remember clearly. try using "ls *" in ftp client and see the difference.

(0013084)
bernhardf
10-08-08 04:21

Does trunk work now like expected? Do you have a testcase that we could put into the testsuite that exposed this bug?

Issue History
Date Modified	Username	Field	Change
07-11-05 10:13	wmq	New Issue
07-11-05 10:13	wmq	File Added: glob.c.mod
07-11-05 18:43	vapier	Note Added: 0000279
07-11-05 20:11	vapier	Note Added: 0000280
07-12-05 10:28	wmq	Note Added: 0000282
10-08-08 04:21	bernhardf	Note Added: 0013084
10-08-08 04:21	bernhardf	Status	assigned => feedback

Notes
(0000279) vapier 07-11-05 18:43	yeah, glibc had this in their updated glob.c: case '\\': if (quote && p[1] != '\0') ++p; break; so i've committed this

(0000280) vapier 07-11-05 20:11	glibc uses this: qsort ((__ptr_t) &pglob->gl_pathv[oldcount], pglob->gl_pathc + pglob->gl_offs - oldcount, but you use this: qsort ((__ptr_t) &pglob->gl_pathv[oldcount + pglob->gl_offs], pglob->gl_pathc - oldcount - pglob->gl_offs,

(0000282) wmq 07-12-05 10:28	I changed the qsort call long time ago, so I don't remember clearly. try using "ls *" in ftp client and see the difference.

(0013084) bernhardf 10-08-08 04:21	Does trunk work now like expected? Do you have a testcase that we could put into the testsuite that exposed this bug?

Relationships