From owner-freebsd-bugs@FreeBSD.ORG Mon Sep 12 22:40:46 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3349416A422 for ; Mon, 12 Sep 2005 22:40:46 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 64BDA43D5C for ; Mon, 12 Sep 2005 22:40:27 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j8CMeMMg016723 for ; Mon, 12 Sep 2005 22:40:22 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j8CMeMTw016722; Mon, 12 Sep 2005 22:40:22 GMT (envelope-from gnats) Resent-Date: Mon, 12 Sep 2005 22:40:22 GMT Resent-Message-Id: <200509122240.j8CMeMTw016722@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Gerd Rausch Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CAB1816A41F for ; Mon, 12 Sep 2005 22:33:02 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9A55543D45 for ; Mon, 12 Sep 2005 22:33:02 +0000 (GMT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id j8CMX2G2058942 for ; Mon, 12 Sep 2005 22:33:02 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id j8CMX2Rw058941; Mon, 12 Sep 2005 22:33:02 GMT (envelope-from nobody) Message-Id: <200509122233.j8CMX2Rw058941@www.freebsd.org> Date: Mon, 12 Sep 2005 22:33:02 GMT From: Gerd Rausch To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Cc: Subject: misc/86038: glob(3) function GLOB_BRACE flaw X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Sep 2005 22:40:46 -0000 >Number: 86038 >Category: misc >Synopsis: glob(3) function GLOB_BRACE flaw >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Sep 12 22:40:22 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Gerd Rausch >Release: 4.10, 4.11 >Organization: Juniper Networks, Inc. >Environment: >Description: The libc glob function had a bug that when using csh-style GLOB_BRACE: the part of the pattern preceeding a square bracket was skipped. This was caused by re-using "pl" inside an inner loop, whereas "pl" was needed later on again. I guess that bug remained undiscovered since many people don't use GLOB_BRACE with libc's glob function; shells (csh, zsh, etc.) have their own implementation. >How-To-Repeat: Compile & use: "{.[!.],..?,}*" >Fix: --- glob.c- Wed Sep 18 07:13:31 2002 +++ glob.c Mon Sep 12 15:29:11 2005 @@ -247,7 +247,7 @@ { int i; Char *lm, *ls; - const Char *pe, *pm, *pl; + const Char *pe, *pm, *pl, *pl2; Char patbuf[MAXPATHLEN]; /* copy part up to the brace */ @@ -288,14 +288,14 @@ switch (*pm) { case LBRACKET: /* Ignore everything between [] */ - for (pl = pm++; *pm != RBRACKET && *pm != EOS; pm++) + for (pl2 = pm++; *pm != RBRACKET && *pm != EOS; pm++) continue; if (*pm == EOS) { /* * We could not find a matching RBRACKET. * Ignore and just look for RBRACE */ - pm = pl; + pm = pl2; } break; >Release-Note: >Audit-Trail: >Unformatted: