romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 02:37:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

ftp-wildcard: fix matching an empty string with "*[^a]"

Browse source 
.... and avoid advancing the pointer to trigger an out of buffer read.

Detected by OSS-fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5251
Assisted-by: Max Dymond
This commit is contained in:
Daniel Stenberg 2018-01-13 21:52:15 +01:00
parent 25c40c9af9
commit cb5accab9e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 16 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/curl_fnmatch.c
View file

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -376,7 +376,9 @@ static int loop(const unsigned char *pattern, const unsigned char *string)
if(found) {
p = pp + 1;
s++;
if(*s)
/* don't advance if we're matching on an empty string */
s++;
memset(charset, 0, CURLFNM_CHSET_SIZE);
}
else