00db10
commit b3a9f56ba59c3d8eadd3135a1c25c37a63151450
00db10
Author: Andreas Schwab <schwab@suse.de>
00db10
Date:   Wed Jun 18 11:58:45 2014 +0200
00db10
00db10
    Don't read past end of pattern in fnmatch (BZ #17062)
00db10
00db10
diff --git glibc-2.17-c758a686/posix/fnmatch_loop.c glibc-2.17-c758a686/posix/fnmatch_loop.c
00db10
index f79d051..544769b 100644
00db10
--- glibc-2.17-c758a686/posix/fnmatch_loop.c
00db10
+++ glibc-2.17-c758a686/posix/fnmatch_loop.c
00db10
@@ -899,11 +899,8 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
00db10
 
00db10
 	  matched:
00db10
 	    /* Skip the rest of the [...] that already matched.  */
00db10
-	    do
00db10
+	    while ((c = *p++) != L (']'))
00db10
 	      {
00db10
-	      ignore_next:
00db10
-		c = *p++;
00db10
-
00db10
 		if (c == L('\0'))
00db10
 		  /* [... (unterminated) loses.  */
00db10
 		  return FNM_NOMATCH;
00db10
@@ -931,12 +928,11 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
00db10
 
00db10
 			if (c < L('a') || c >= L('z'))
00db10
 			  {
00db10
-			    p = startp;
00db10
-			    goto ignore_next;
00db10
+			    p = startp - 2;
00db10
+			    break;
00db10
 			  }
00db10
 		      }
00db10
 		    p += 2;
00db10
-		    c = *p++;
00db10
 		  }
00db10
 		else if (c == L('[') && *p == L('='))
00db10
 		  {
00db10
@@ -947,7 +943,6 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
00db10
 		    if (c != L('=') || p[1] != L(']'))
00db10
 		      return FNM_NOMATCH;
00db10
 		    p += 2;
00db10
-		    c = *p++;
00db10
 		  }
00db10
 		else if (c == L('[') && *p == L('.'))
00db10
 		  {
00db10
@@ -962,10 +957,8 @@ FCT (pattern, string, string_end, no_leading_period, flags, ends, alloca_used)
00db10
 			  break;
00db10
 		      }
00db10
 		    p += 2;
00db10
-		    c = *p++;
00db10
 		  }
00db10
 	      }
00db10
-	    while (c != L(']'));
00db10
 	    if (not)
00db10
 	      return FNM_NOMATCH;
00db10
 	  }
00db10
diff --git glibc-2.17-c758a686/posix/tst-fnmatch3.c glibc-2.17-c758a686/posix/tst-fnmatch3.c
00db10
new file mode 100644
00db10
index 0000000..2a83c1b
00db10
--- /dev/null
00db10
+++ glibc-2.17-c758a686/posix/tst-fnmatch3.c
00db10
@@ -0,0 +1,30 @@
00db10
+/* Test for fnmatch not reading past the end of the pattern.
00db10
+   Copyright (C) 2014 Free Software Foundation, Inc.
00db10
+   This file is part of the GNU C Library.
00db10
+
00db10
+   The GNU C Library is free software; you can redistribute it and/or
00db10
+   modify it under the terms of the GNU Lesser General Public
00db10
+   License as published by the Free Software Foundation; either
00db10
+   version 2.1 of the License, or (at your option) any later version.
00db10
+
00db10
+   The GNU C Library is distributed in the hope that it will be useful,
00db10
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
00db10
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
00db10
+   Lesser General Public License for more details.
00db10
+
00db10
+   You should have received a copy of the GNU Lesser General Public
00db10
+   License along with the GNU C Library; if not, see
00db10
+   <http://www.gnu.org/licenses/>.  */
00db10
+
00db10
+#include <fnmatch.h>
00db10
+
00db10
+int
00db10
+do_test (void)
00db10
+{
00db10
+  const char *pattern = "[[:alpha:]'[:alpha:]\0]";
00db10
+
00db10
+  return fnmatch (pattern, "a", 0) != FNM_NOMATCH;
00db10
+}
00db10
+
00db10
+#define TEST_FUNCTION do_test ()
00db10
+#include "../test-skeleton.c"
00db10
--- glibc-2.17-c758a686/posix/Makefile	2015-05-15 16:00:01.000000000 -0400
00db10
+++ glibc-2.17-c758a686/posix/Makefile	2015-05-29 18:34:07.507240952 -0400
00db10
@@ -87,7 +87,7 @@
00db10
 		   tst-getaddrinfo3 tst-fnmatch2 tst-cpucount tst-cpuset \
00db10
 		   bug-getopt1 bug-getopt2 bug-getopt3 bug-getopt4 \
00db10
 		   bug-getopt5 tst-getopt_long1 bug-regex34 \
00db10
-		   tst-pathconf
00db10
+		   tst-pathconf tst-fnmatch3
00db10
 xtests		:= bug-ga2
00db10
 ifeq (yes,$(build-shared))
00db10
 test-srcs	:= globtest