[openssh-commits] [openssh] branch master updated: update glob.c from upstream OpemBSD libc

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

The following commit(s) were added to refs/heads/master by this push:
     new 976483171 update glob.c from upstream OpemBSD libc
976483171 is described below

commit 97648317199613d06247bf4cc4d44a95f250c532
Author: Damien Miller <djm at mindrot.org>
AuthorDate: Mon Oct 26 16:16:12 2026 +1100

    update glob.c from upstream OpemBSD libc
    
    revision 1.51
    date: 2026/10/24 18:08:57;  author: millert;  state: Exp;  lines: +12 -1;  commitid: eQplLAFWij3oMfPf;
    Fix out-of-bounds read on on missing right bracket after character class.
    
    The original code checked for a closing bracket before parsing the
    bracket expression.  When character class support was added, that
    closing bracket can now be part of the character class instead.
    Add another check for the closing bracket after parsing character
    classes and roll back if we don't find one.
    
    Adapted from an OpenSSH bug report.  OK djm@
---
 openbsd-compat/glob.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/openbsd-compat/glob.c b/openbsd-compat/glob.c
index 330b9c0aa..c832224d2 100644
--- a/openbsd-compat/glob.c
+++ b/openbsd-compat/glob.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: glob.c,v 1.49 2020/04/21 08:25:22 dtucker Exp $ */
+/*	$OpenBSD: glob.c,v 1.51 2026/10/24 18:08:57 millert Exp $ */
 /*
  * Copyright (c) 1989, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -501,6 +501,9 @@ glob0(const Char *pattern, glob_t *pglob, struct glob_lim *limitp)
 			c = *qpatnext++;
 			do {
 				if (c == LBRACKET && *qpatnext == ':') {
+					const Char *oqpatnext = qpatnext;
+					Char *obufnext = bufnext;
+
 					do {
 						err = g_charclass(&qpatnext,
 						    &bufnext);
@@ -513,6 +516,14 @@ glob0(const Char *pattern, glob_t *pglob, struct glob_lim *limitp)
 						return GLOB_NOMATCH;
 					if (c == RBRACKET)
 						break;
+					if (c == EOS ||
+					    g_strchr(qpatnext, RBRACKET) == NULL) {
+						/* No matching RBRACKET, undo */
+						c = LBRACKET;
+						bufnext = obufnext;
+						qpatnext = oqpatnext;
+						break;
+					}
 				}
 				*bufnext++ = CHAR(c);
 				if (*qpatnext == RANGE &&

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.