diff options
| author | Paul Pluzhnikov <ppluzhnikov@google.com> | 2015-03-06 09:13:16 -0800 |
|---|---|---|
| committer | Paul Pluzhnikov <ppluzhnikov@google.com> | 2015-03-06 09:13:16 -0800 |
| commit | 895c30cb003857b52c1675f9078e6a799b231bcb (patch) | |
| tree | 5efa6be9373ca6e1d8dafe195aa639c19060e494 /posix/wordexp.c | |
| parent | 5df56c7e3a236b39b3395e042015b541172f652b (diff) | |
| download | glibc-895c30cb003857b52c1675f9078e6a799b231bcb.tar glibc-895c30cb003857b52c1675f9078e6a799b231bcb.tar.gz glibc-895c30cb003857b52c1675f9078e6a799b231bcb.tar.bz2 glibc-895c30cb003857b52c1675f9078e6a799b231bcb.zip | |
Fix BZ #18043: buffer-overflow (read past the end) in wordexp/parse_dollars/parse_param
Diffstat (limited to 'posix/wordexp.c')
| -rw-r--r-- | posix/wordexp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/posix/wordexp.c b/posix/wordexp.c index e3d8d6bd0d..1c144014b3 100644 --- a/posix/wordexp.c +++ b/posix/wordexp.c @@ -1299,7 +1299,7 @@ parse_param (char **word, size_t *word_length, size_t *max_length, } while (isdigit(words[++*offset])); } - else if (strchr ("*@$", words[*offset]) != NULL) + else if (words[*offset] != '\0' && strchr ("*@$", words[*offset]) != NULL) { /* Special parameter. */ special = 1; |