Ticket #1185: glibc-2.26-glob_fixes-1.patch

ChangeLog

@@ +1 @@
+2017-08-20  H.J. Lu  <hongjiu.lu@intel.com>
+
+        [BZ #18822]
+        * sysdeps/unix/sysv/linux/i386/glob64.c (__old_glob64): Add
+        libc_hidden_proto and libc_hidden_def.
+
+2017-09-08  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+
+        [BZ #1062]
+        [BZ #22325]
+        CVE-2017-15671
+        * posix/Makefile (routines): Add globfree, globfree64, and
+        glob_pattern_p.
+        * posix/flexmember.h: New file.
+        * posix/glob_internal.h: Likewise.
+        * posix/glob_pattern_p.c: Likewise.
+        * posix/globfree.c: Likewise.
+        * posix/globfree64.c: Likewise.
+        * sysdeps/gnu/globfree64.c: Likewise.
+        * sysdeps/unix/sysv/linux/alpha/globfree.c: Likewise.
+        * sysdeps/unix/sysv/linux/mips/mips64/n64/globfree64.c: Likewise.
+        * sysdeps/unix/sysv/linux/oldglob.c: Likewise.
+        * sysdeps/unix/sysv/linux/wordsize-64/globfree64.c: Likewise.
+        * sysdeps/unix/sysv/linux/x86_64/x32/globfree.c: Likewise.
+        * sysdeps/wordsize-64/globfree.c: Likewise.
+        * sysdeps/wordsize-64/globfree64.c: Likewise.
+        * posix/glob.c (HAVE_CONFIG_H): Use !_LIBC instead.
+        [NDEBUG): Remove comments.
+        (GLOB_ONLY_P, _AMIGA, VMS): Remove define.
+        (dirent_type): New type.  Use uint_fast8_t not
+        uint8_t, as C99 does not require uint8_t.
+        (DT_UNKNOWN, DT_DIR, DT_LNK): New macros.
+        (struct readdir_result): Use dirent_type.  Do not define skip_entry
+        unless it is needed; this saves a byte on platforms lacking d_ino.
+        (readdir_result_type, readdir_result_skip_entry):
+        New functions, replacing ...
+        (readdir_result_might_be_symlink, readdir_result_might_be_dir):
+         these functions, which were removed.  This makes the callers
+        easier to read.  All callers changed.
+        (D_INO_TO_RESULT): Now empty if there is no d_ino.
+        (size_add_wrapv, glob_use_alloca): New static functions.
+        (glob, glob_in_dir): Check for size_t overflow in several places,
+        and fix some size_t checks that were not quite right.
+        Remove old code using SHELL since Bash no longer
+        uses this.
+        (glob, prefix_array): Separate MS code better.
+        (glob_in_dir): Remove old Amiga and VMS code.
+        (globfree, __glob_pattern_type, __glob_pattern_p): Move to
+        separate files.
+        (glob_in_dir): Do not rely on undefined behavior in accessing
+        struct members beyond their bounds.  Use a flexible array member
+        instead
+        (link_stat): Rename from link_exists2_p and return -1/0 instead of
+        0/1.  Caller changed.
+        (glob): Fix memory leaks.
+        * posix/glob64 (globfree64): Move to separate file.
+        * sysdeps/gnu/glob64.c (NO_GLOB_PATTERN_P): Remove define.
+        (globfree64): Remove hidden alias.
+        * sysdeps/unix/sysv/linux/Makefile (sysdeps_routines): Add
+        oldglob.
+        * sysdeps/unix/sysv/linux/alpha/glob.c (__new_globfree): Move to
+        separate file.
+        * sysdeps/unix/sysv/linux/i386/glob64.c (NO_GLOB_PATTERN_P): Remove
+        define.
+        Move compat code to separate file.
+        * sysdeps/wordsize-64/glob.c (globfree): Move definitions to
+        separate file.
+
+2017-10-20  Paul Eggert <eggert@cs.ucla.edu>
+
+        [BZ #22320]
+        CVE-2017-15670
+        * posix/glob.c (__glob): Fix one-byte overflow.
+
+2017-10-21  Florian Weimer  <fweimer@redhat.com>
+
+        * posix/Makefile (tests): Add tst-glob-tilde.
+        (tests-special): Add tst-glob-tilde-mem.out
+        (tst-glob-tilde-ENV): Set MALLOC_TRACE.
+        (tst-glob-tilde-mem.out): Add mtrace check.
+        * posix/tst-glob-tilde.c: New file.
+
+2017-09-08  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+
+        * sysdeps/unix/sysv/linux/arm/glob64.c: Remove file.
+        * sysdeps/unix/sysv/linux/i386/glob64.c: Likewise.
+        * sysdeps/unix/sysv/linux/m68k/glob64.c: Likewise.
+        * sysdeps/unix/sysv/linux/mips/mips64/n64/glob64.c: Likewise.
+        * sysdeps/unix/sysv/linux/mips/mips64/n64/globfree64.c: Likewise.
+        * sysdeps/unix/sysv/linux/powerpc/powerpc32/glob64.c: Likewise.
+        * sysdeps/unix/sysv/linux/sparc/sparc32/glob64.c: Likewise.
+        * sysdeps/unix/sysv/linux/wordsize-64/glob64.c: Likewise.
+        * sysdeps/unix/sysv/linux/wordsize-64/globfree64.c: Likewise.
+        * sysdeps/unix/sysv/linux/x86_64/x32/glob.c: Likewise.
+        * sysdeps/unix/sysv/linux/x86_64/x32/globfree.c: Likewise.
+        * sysdeps/wordsize-64/glob.c: Likewise.
+        * sysdeps/wordsize-64/glob64.c: Likewise.
+        * sysdeps/wordsize-64/globfree.c: Likewise.
+        * sysdeps/wordsize-64/globfree64.c: Likewise.
+        * sysdeps/unix/sysv/linux/glob.c: New file.
+        * sysdeps/unix/sysv/linux/glob64.c: Likewise.
+        * sysdeps/unix/sysv/linux/globfree.c: Likewise.
+        * sysdeps/unix/sysv/linux/globfree64.c: Likewise.
+        * sysdeps/unix/sysv/linux/s390/s390-32/glob64.c: Likewise.
+        * sysdeps/unix/sysv/linux/oldglob.c [SHLIB_COMPAT]: Also
+        adds !GLOB_NO_OLD_VERSION as an extra condition.
+        * sysdeps/unix/sysv/linux/i386/alphasort64.c: Include olddirent.h
+        using relative path instead of absolute one.
+        * sysdeps/unix/sysv/linux/i386/getdents64.c: Likewise.
+        * sysdeps/unix/sysv/linux/i386/readdir64.c: Likewise.
+        * sysdeps/unix/sysv/linux/i386/readdir64_r.c: Likewise.
+        * sysdeps/unix/sysv/linux/i386/versionsort64.c: Likewise.
+        * sysdeps/unix/sysv/linux/i386/olddirent.h: Move to ...
+        * sysdeps/unix/sysv/linux//olddirent.h: ... here.
+
+2017-09-13  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+
+        * sysdeps/unix/sysv/linux/s390/s390-32/oldglob.c: New file.
+        * sysdeps/unix/sysv/linux/alpha/Makefile
+        [$(subdir) = csu] (sysdep_routines): Remove rule.
+
+2017-10-22  Paul Eggert <eggert@cs.ucla.edu>
+
+        [BZ #22332]
+        * posix/glob.c (__glob): Fix buffer overflow during GLOB_TILDE
+        unescaping.
+
 2017-08-02  Siddhesh Poyarekar  <siddhesh@sourceware.org>
 
         * version.h (RELEASE): Set to "stable"

glibc-2.26

@@ -5 +5 @@
 Please send GNU C library bug reports via <http://sourceware.org/bugzilla/>
 using `glibc' in the "product" field.
 
 
+Version 2.26.1
+
+  CVE-2017-15670: The glob function, when invoked with GLOB_TILDE,
+  suffered from a one-byte overflow during ~ operator processing (either
+  on the stack or the heap, depending on the length of the user name).
+  Reported by Tim RÃŒhsen.
+
+  The glob function, when invoked with GLOB_TILDE and without
+  GLOB_NOESCAPE, could write past the end of a buffer while
+  unescaping user names.  Reported by Tim RÃŒhsen.
+
+The following bugs are resolved with this release:
+
+  [22325] glibc: Memory leak in glob with GLOB_TILDE (CVE-2017-15671)
+  [21885] getaddrinfo: Release resolver context on error in gethosts
+
 
 Version 2.26

posix/Makefile

@@ -45 +45 @@
         getpgid setpgid getpgrp bsd-getpgrp setpgrp getsid setsid             \
         getresuid getresgid setresuid setresgid                               \
         pathconf sysconf fpathconf                                            \
-        glob glob64 fnmatch regex                                             \
+        glob glob64 globfree globfree64 glob_pattern_p fnmatch regex          \
         confstr                                                               \
         getopt getopt1                                                        \
         sched_setp sched_getp sched_sets sched_gets sched_yield sched_primax  \
@@ -93 +93 @@
                    tst-fnmatch3 bug-regex36 tst-getaddrinfo5 \
                    tst-posix_spawn-fd tst-posix_spawn-setsid \
                    tst-posix_fadvise tst-posix_fadvise64 \
-                   tst-sysconf-empty-chroot
+                   tst-sysconf-empty-chroot tst-glob-tilde
 tests-internal  := bug-regex5 bug-regex20 bug-regex33 \
                    tst-rfc3484 tst-rfc3484-2 tst-rfc3484-3
 xtests          := bug-ga2
@@ -141 +141 @@
                  $(objpfx)tst-rxspencer-no-utf8-mem.out $(objpfx)tst-pcre-mem.out \
                  $(objpfx)tst-boost-mem.out $(objpfx)tst-getconf.out \
                  $(objpfx)bug-glob2-mem.out $(objpfx)tst-vfork3-mem.out \
-                 $(objpfx)tst-fnmatch-mem.out $(objpfx)bug-regex36-mem.out
+                 $(objpfx)tst-fnmatch-mem.out $(objpfx)bug-regex36-mem.out \
+                 $(objpfx)tst-glob-tilde-mem.out
 xtests-special += $(objpfx)bug-ga2-mem.out
 endif
 
@@ -350 +351 @@
         $(common-objpfx)malloc/mtrace $(objpfx)bug-glob2.mtrace > $@; \
         $(evaluate-test)
 
+tst-glob-tilde-ENV = MALLOC_TRACE=$(objpfx)tst-glob-tilde.mtrace
+
+$(objpfx)tst-glob-tilde-mem.out: $(objpfx)tst-glob-tilde.out
+        $(common-objpfx)malloc/mtrace $(objpfx)tst-glob-tilde.mtrace > $@; \
+        $(evaluate-test)
+
 $(inst_libexecdir)/getconf: $(inst_bindir)/getconf \
                             $(objpfx)getconf.speclist FORCE
         $(addprefix $(..)./scripts/mkinstalldirs ,\

posix/flexmember.h

@@ +1 @@
+/* Sizes of structs with flexible array members.
+
+   Copyright 2016-2017 Free Software Foundation, Inc.
+
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.
+
+   Written by Paul Eggert.  */
+
+#include <stddef.h>
+
+/* Nonzero multiple of alignment of TYPE, suitable for FLEXSIZEOF below.
+   On older platforms without _Alignof, use a pessimistic bound that is
+   safe in practice even if FLEXIBLE_ARRAY_MEMBER is 1.
+   On newer platforms, use _Alignof to get a tighter bound.  */
+
+#if !defined __STDC_VERSION__ || __STDC_VERSION__ < 201112
+# define FLEXALIGNOF(type) (sizeof (type) & ~ (sizeof (type) - 1))
+#else
+# define FLEXALIGNOF(type) _Alignof (type)
+#endif
+
+/* Upper bound on the size of a struct of type TYPE with a flexible
+   array member named MEMBER that is followed by N bytes of other data.
+   This is not simply sizeof (TYPE) + N, since it may require
+   alignment on unusually picky C11 platforms, and
+   FLEXIBLE_ARRAY_MEMBER may be 1 on pre-C11 platforms.
+   Yield a value less than N if and only if arithmetic overflow occurs.  */
+
+#define FLEXSIZEOF(type, member, n) \
+   ((offsetof (type, member) + FLEXALIGNOF (type) - 1 + (n)) \
+    & ~ (FLEXALIGNOF (type) - 1))

posix/glob.c

@@ -15 +15 @@
    License along with the GNU C Library; if not, see
    <http://www.gnu.org/licenses/>.  */
 
-#ifdef  HAVE_CONFIG_H
+#ifndef _LIBC
 # include <config.h>
 #endif
 
@@ -27 +27 @@
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
-
-/* Outcomment the following line for production quality code.  */
-/* #define NDEBUG 1 */
 #include <assert.h>
+#include <unistd.h>
 
-#include <stdio.h>              /* Needed on stupid SunOS for assert.  */
-
-#if !defined _LIBC || !defined GLOB_ONLY_P
-#if defined HAVE_UNISTD_H || defined _LIBC
-# include <unistd.h>
-# ifndef POSIX
-#  ifdef _POSIX_VERSION
-#   define POSIX
-#  endif
-# endif
+#if (defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__
+# define WINDOWS32
 #endif
 
-#include <pwd.h>
-
-#if defined HAVE_STDINT_H || defined _LIBC
-# include <stdint.h>
-#elif !defined UINTPTR_MAX
-# define UINTPTR_MAX (~((size_t) 0))
+#ifndef WINDOWS32
+# include <pwd.h>
 #endif
 
 #include <errno.h>
@@ -57 +43 @@
 # define __set_errno(val) errno = (val)
 #endif
 
-#if defined HAVE_DIRENT_H || defined __GNU_LIBRARY__
-# include <dirent.h>
-#else
-# define dirent direct
-# ifdef HAVE_SYS_NDIR_H
-#  include <sys/ndir.h>
-# endif
-# ifdef HAVE_SYS_DIR_H
-#  include <sys/dir.h>
-# endif
-# ifdef HAVE_NDIR_H
-#  include <ndir.h>
-# endif
-# ifdef HAVE_VMSDIR_H
-#  include "vmsdir.h"
-# endif /* HAVE_VMSDIR_H */
-#endif
-
+#include <dirent.h>
 #include <stdlib.h>
 #include <string.h>
 #include <alloca.h>
@@ -87 +56 @@
 # define opendir(name) __opendir (name)
 # define readdir(str) __readdir64 (str)
 # define getpwnam_r(name, bufp, buf, len, res) \
-   __getpwnam_r (name, bufp, buf, len, res)
+    __getpwnam_r (name, bufp, buf, len, res)
 # ifndef __stat64
 #  define __stat64(fname, buf) __xstat64 (_STAT_VER, fname, buf)
 # endif
 # define struct_stat64          struct stat64
+# define FLEXIBLE_ARRAY_MEMBER
 #else /* !_LIBC */
-# include "getlogin_r.h"
-# include "mempcpy.h"
-# include "stat-macros.h"
-# include "strdup.h"
-# define __stat64(fname, buf)   stat (fname, buf)
-# define struct_stat64          struct stat
-# define __stat(fname, buf)     stat (fname, buf)
-# define __alloca               alloca
-# define __readdir              readdir
-# define __readdir64            readdir64
-# define __glob_pattern_p       glob_pattern_p
+# define __getlogin_r(buf, len) getlogin_r (buf, len)
+# define __stat64(fname, buf)   stat (fname, buf)
+# define __fxstatat64(_, d, f, st, flag) fstatat (d, f, st, flag)
+# define struct_stat64          struct stat
+# ifndef __MVS__
+#  define __alloca              alloca
+# endif
+# define __readdir              readdir
+# define COMPILE_GLOB64
 #endif /* _LIBC */
 
 #include <fnmatch.h>
 
+#include <flexmember.h>
+#include <glob_internal.h>
+
 #ifdef _SC_GETPW_R_SIZE_MAX
 # define GETPW_R_SIZE_MAX()     sysconf (_SC_GETPW_R_SIZE_MAX)
 #else
@@ -121 +92 @@
 
 
 static const char *next_brace_sub (const char *begin, int flags) __THROWNL;
 
+typedef uint_fast8_t dirent_type;
+
+#if !defined _LIBC && !defined HAVE_STRUCT_DIRENT_D_TYPE
+/* Any distinct values will do here.
+   Undef any existing macros out of the way.  */
+# undef DT_UNKNOWN
+# undef DT_DIR
+# undef DT_LNK
+# define DT_UNKNOWN 0
+# define DT_DIR 1
+# define DT_LNK 2
+#endif
+
 /* A representation of a directory entry which does not depend on the
    layout of struct dirent, or the size of ino_t.  */
 struct readdir_result
 {
   const char *name;
-# if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
-  uint8_t type;
-# endif
+#if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
+  dirent_type type;
+#endif
+#if defined _LIBC || defined D_INO_IN_DIRENT
   bool skip_entry;
+#endif
 };
 
-# if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
-/* Initializer based on the d_type member of struct dirent.  */
-#  define D_TYPE_TO_RESULT(source) (source)->d_type,
-
-/* True if the directory entry D might be a symbolic link.  */
-static bool
-readdir_result_might_be_symlink (struct readdir_result d)
-{
-  return d.type == DT_UNKNOWN || d.type == DT_LNK;
-}
-
-/* True if the directory entry D might be a directory.  */
-static bool
-readdir_result_might_be_dir (struct readdir_result d)
-{
-  return d.type == DT_DIR || readdir_result_might_be_symlink (d);
-}
-# else /* defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE */
-#  define D_TYPE_TO_RESULT(source)
-
-/* If we do not have type information, symbolic links and directories
-   are always a possibility.  */
-
-static bool
-readdir_result_might_be_symlink (struct readdir_result d)
+/* Initialize and return type member of struct readdir_result.  */
+static dirent_type
+readdir_result_type (struct readdir_result d)
 {
-  return true;
+#if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
+# define D_TYPE_TO_RESULT(source) (source)->d_type,
+  return d.type;
+#else
+# define D_TYPE_TO_RESULT(source)
+  return DT_UNKNOWN;
+#endif
 }
 
+/* Initialize and return skip_entry member of struct readdir_result.  */
 static bool
-readdir_result_might_be_dir (struct readdir_result d)
+readdir_result_skip_entry (struct readdir_result d)
 {
-  return true;
-}
-
-# endif /* defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE */
-
-# if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
 /* Initializer for skip_entry.  POSIX does not require that the d_ino
    field be present, and some systems do not provide it. */
-#  define D_INO_TO_RESULT(source) false,
-# else
-#  define D_INO_TO_RESULT(source) (source)->d_ino == 0,
-# endif
+#if defined _LIBC || defined D_INO_IN_DIRENT
+# define D_INO_TO_RESULT(source) (source)->d_ino == 0,
+  return d.skip_entry;
+#else
+# define D_INO_TO_RESULT(source)
+  return false;
+#endif
+}
 
 /* Construct an initializer for a struct readdir_result object from a

posix/glob64.c

@@ -43 +43 @@
 }
 libc_hidden_def (glob64)
 
-void
-globfree64 (glob64_t *pglob)
-{
-}
-libc_hidden_def (globfree64)
-
 stub_warning (glob64)

posix/glob_internal.h

@@ +1 @@
+/* Shared definition for glob and glob_pattern_p.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#ifndef GLOB_INTERNAL_H
+# define GLOB_INTERNAL_H
+
+static inline int
+__glob_pattern_type (const char *pattern, int quote)
+{
+  const char *p;
+  int ret = 0;
+
+  for (p = pattern; *p != '\0'; ++p)
+    switch (*p)
+      {
+      case '?':
+      case '*':
+        return 1;
+
+      case '\\':
+        if (quote)
+          {
+            if (p[1] != '\0')
+              ++p;
+            ret |= 2;
+          }
+        break;
+
+      case '[':
+        ret |= 4;
+        break;
+
+      case ']':
+        if (ret & 4)
+          return 1;
+        break;
+      }
+
+  return ret;
+}
+
+#endif /* GLOB_INTERNAL_H  */

posix/glob_pattern_p.c

@@ +1 @@
+/* Return nonzero if PATTERN contains any metacharacters.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#ifndef _LIBC
+# include <config.h>
+#endif
+
+#include <glob.h>
+#include "glob_internal.h"
+
+/* Return nonzero if PATTERN contains any metacharacters.
+   Metacharacters can be quoted with backslashes if QUOTE is nonzero.  */
+int
+__glob_pattern_p (const char *pattern, int quote)
+{
+  return __glob_pattern_type (pattern, quote) == 1;
+}
+weak_alias (__glob_pattern_p, glob_pattern_p)

posix/globfree.c

@@ +1 @@
+/* Frees the dynamically allocated storage from an earlier call to glob.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#ifndef _LIBC
+# include <config.h>
+#endif
+
+#include <glob.h>
+#include <stdlib.h>
+
+/* Free storage allocated in PGLOB by a previous `glob' call.  */
+void
+globfree (glob_t *pglob)
+{
+  if (pglob->gl_pathv != NULL)
+    {
+      size_t i;
+      for (i = 0; i < pglob->gl_pathc; ++i)
+        free (pglob->gl_pathv[pglob->gl_offs + i]);
+      free (pglob->gl_pathv);
+      pglob->gl_pathv = NULL;
+    }
+}
+#ifndef globfree
+libc_hidden_def (globfree)
+#endif

posix/globfree64.c

@@ +1 @@
+/* Frees the dynamically allocated storage from an earlier call to glob.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#ifndef _LIBC
+# include <config.h>
+#endif
+
+#include <glob.h>
+#include <stdlib.h>
+
+/* Free storage allocated in PGLOB by a previous `glob' call.  */
+void
+globfree64 (glob64_t *pglob)
+{
+}
+libc_hidden_def (globfree64)

posix/tst-glob-tilde.c

@@ +1 @@
+/* Check for GLOB_TIDLE heap allocation issues (bugs 22320, 22325, 22332).
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <glob.h>
+#include <mcheck.h>
+#include <nss.h>
+#include <pwd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <support/check.h>
+#include <support/support.h>
+
+/* Flag which indicates whether to pass the GLOB_ONLYDIR flag.  */
+static int do_onlydir;
+
+/* Flag which indicates whether to pass the GLOB_NOCHECK flag.  */
+static int do_nocheck;
+
+/* Flag which indicates whether to pass the GLOB_MARK flag.  */
+static int do_mark;
+
+/* Flag which indicates whether to pass the GLOB_NOESCAPE flag.  */
+static int do_noescape;
+
+static void
+one_test (const char *prefix, const char *middle, const char *suffix)
+{
+  char *pattern = xasprintf ("%s%s%s", prefix, middle, suffix);
+  int flags = GLOB_TILDE;
+  if (do_onlydir)
+    flags |= GLOB_ONLYDIR;
+  if (do_nocheck)
+    flags |= GLOB_NOCHECK;
+  if (do_mark)
+    flags |= GLOB_MARK;
+  if (do_noescape)
+    flags |= GLOB_NOESCAPE;
+  glob_t gl;
+  /* This glob call might result in crashes or memory leaks.  */
+  if (glob (pattern, flags, NULL, &gl) == 0)
+    globfree (&gl);
+  free (pattern);
+}
+
+enum
+  {
+    /* The largest base being tested.  */
+    largest_base_size = 500000,
+
+    /* The actual size is the base size plus a variable whose absolute
+       value is not greater than this.  This helps malloc to trigger
+       overflows.  */
+    max_size_skew = 16,
+
+    /* The maximum string length supported by repeating_string
+       below.  */
+    repeat_size = largest_base_size + max_size_skew,
+  };
+
+/* Used to construct strings which repeat a single character 'x'.  */
+static char *repeat;
+
+/* Return a string of SIZE characters.  */
+const char *
+repeating_string (int size)
+{
+  TEST_VERIFY (size >= 0);
+  TEST_VERIFY (size <= repeat_size);
+  const char *repeated_shifted = repeat + repeat_size - size;
+  TEST_VERIFY (strlen (repeated_shifted) == size);
+  return repeated_shifted;
+}
+
+static int
+do_test (void)
+{
+  /* Avoid network-based NSS modules and initialize nss_files with a
+     dummy lookup.  This has to come before mtrace because NSS does
+     not free all memory.  */
+  __nss_configure_lookup ("passwd", "files");
+  (void) getpwnam ("root");
+
+  mtrace ();
+
+  repeat = xmalloc (repeat_size + 1);
+  memset (repeat, 'x', repeat_size);
+  repeat[repeat_size] = '\0';
+
+  /* These numbers control the size of the user name.  The values
+     cover the minimum (0), a typical size (8), a large
+     stack-allocated size (100000), and a somewhat large
+     heap-allocated size (largest_base_size).  */
+  static const int base_sizes[] = { 0, 8, 100, 100000, largest_base_size, -1 };
+
+  for (do_onlydir = 0; do_onlydir < 2; ++do_onlydir)
+    for (do_nocheck = 0; do_nocheck < 2; ++do_nocheck)
+      for (do_mark = 0; do_mark < 2; ++do_mark)
+        for (do_noescape = 0; do_noescape < 2; ++do_noescape)
+          for (int base_idx = 0; base_sizes[base_idx] >= 0; ++base_idx)
+            {
+              for (int size_skew = -max_size_skew; size_skew <= max_size_skew;
+                   ++size_skew)
+                {
+                  int size = base_sizes[base_idx] + size_skew;
+                  if (size < 0)
+                    continue;
+
+                  const char *user_name = repeating_string (size);
+                  one_test ("~", user_name, "/a/b");
+                  one_test ("~", user_name, "x\\x\\x////x\\a");
+                }
+
+              const char *user_name = repeating_string (base_sizes[base_idx]);
+              one_test ("~", user_name, "");
+              one_test ("~", user_name, "/");
+              one_test ("~", user_name, "/a");
+              one_test ("~", user_name, "/*/*");
+              one_test ("~", user_name, "\\/");
+              one_test ("/~", user_name, "");
+              one_test ("*/~", user_name, "/a/b");
+            }
+
+  free (repeat);
+
+  return 0;
+}
+
+#include <support/test-driver.c>

sysdeps/gnu/glob64.c

@@ -15 +15 @@
 #undef __stat
 #define __stat(file, buf) __xstat64 (_STAT_VER, file, buf)
 
-#define NO_GLOB_PATTERN_P 1
-
 #define COMPILE_GLOB64  1
 
 #include <posix/glob.c>
 
 libc_hidden_def (glob64)
-libc_hidden_def (globfree64)

sysdeps/gnu/globfree64.c

@@ +1 @@
+#include <dirent.h>
+#include <glob.h>
+#include <sys/stat.h>
+
+#define glob_t glob64_t
+#define globfree(pglob) globfree64 (pglob)
+
+#include <posix/globfree.c>
+
+libc_hidden_def (globfree64)

sysdeps/posix/getaddrinfo.c

@@ -255 +255 @@
       break;                                                                  \
     if (!scratch_buffer_grow (tmpbuf))                                        \
       {                                                                       \
+        __resolv_context_enable_inet6 (res_ctx, res_enable_inet6);            \
+        __resolv_context_put (res_ctx);                                       \
         result = -EAI_MEMORY;                                                 \
         goto free_and_return;                                                 \
       }                                                                       \

sysdeps/unix/sysv/linux/Makefile

@@ -162 +162 @@
 ifeq ($(subdir),posix)
 sysdep_headers += bits/initspin.h
 
-sysdep_routines += sched_getcpu
+sysdep_routines += sched_getcpu oldglob
 
 tests += tst-affinity tst-affinity-pid
 

sysdeps/unix/sysv/linux/alpha/Makefile

@@ -1 @@
-ifeq ($(subdir),posix)
-sysdep_routines += oldglob
-endif
-
 ifeq ($(subdir),stdlib)
 gen-as-const-headers += ucontext-offsets.sym
 endif

sysdeps/unix/sysv/linux/alpha/glob.c

@@ -42 +42 @@
 #undef globfree64
 
 versioned_symbol (libc, __new_glob, glob, GLIBC_2_1);
-versioned_symbol (libc, __new_globfree, globfree, GLIBC_2_1);
 libc_hidden_ver (__new_glob, glob)
-libc_hidden_ver (__new_globfree, globfree)
 
 weak_alias (__new_glob, glob64)
-weak_alias (__new_globfree, globfree64)
-libc_hidden_ver (__new_globfree, globfree64)

sysdeps/unix/sysv/linux/alpha/globfree.c

@@ +1 @@
+/* Compat globfree.  Linux/alpha version.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library.  If not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#define globfree64 __no_globfree64_decl
+#include <sys/types.h>
+#include <glob.h>
+#include <shlib-compat.h>
+
+#define globfree(pglob) \
+  __new_globfree (pglob)
+
+extern void __new_globfree (glob_t *__pglob);
+
+#include <posix/globfree.c>
+
+#undef globfree64
+
+versioned_symbol (libc, __new_globfree, globfree, GLIBC_2_1);
+libc_hidden_ver (__new_globfree, globfree)
+
+weak_alias (__new_globfree, globfree64)
+libc_hidden_ver (__new_globfree, globfree64)

sysdeps/unix/sysv/linux/arm/glob64.c

@@ -1 @@
-#include <sysdeps/unix/sysv/linux/i386/glob64.c>

sysdeps/unix/sysv/linux/glob.c

@@ +1 @@
+/* Find pathnames matching a pattern.  Linux version.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <sys/stat.h>
+#include <kernel_stat.h>
+
+#define glob64 __no_glob64_decl
+#include <posix/glob.c>
+#undef glob64
+
+#if XSTAT_IS_XSTAT64
+weak_alias (glob, glob64)
+#endif

sysdeps/unix/sysv/linux/globfree.c

@@ +1 @@
+/* Frees the dynamically allocated storage from an earlier call to glob.
+   Linux version.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <sys/stat.h>
+#include <kernel_stat.h>
+
+#define globfree64 __no_globfree64_decl
+#include <posix/globfree.c>
+#undef globfree64
+
+#if XSTAT_IS_XSTAT64
+weak_alias (globfree, globfree64)
+libc_hidden_ver (globfree, globfree64)
+#endif

sysdeps/unix/sysv/linux/globfree64.c

@@ +1 @@
+/* Frees the dynamically allocated storage from an earlier call to glob.
+   Linux version.
+   Copyright (C) 2017 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <sys/stat.h>
+#include <kernel_stat.h>
+
+#if !XSTAT_IS_XSTAT64
+
+# include <glob.h>
+
+# define glob_t glob64_t
+# define globfree(pglob) globfree64 (pglob)
+
+# undef stat
+# define stat stat64
+
+# include <posix/globfree.c>
+
+libc_hidden_def (globfree64)
+#endif

sysdeps/unix/sysv/linux/i386/alphasort64.c

@@ -30 +30 @@
 
 #if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2)
 
-#include <sysdeps/unix/sysv/linux/i386/olddirent.h>
+#include <olddirent.h>
 
 int
 __old_alphasort64 (const struct __old_dirent64 **a,

sysdeps/unix/sysv/linux/i386/getdents64.c

@@ -28 +28 @@
 
 #if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2)
 
-#include <sysdeps/unix/sysv/linux/i386/olddirent.h>
+#include <olddirent.h>
 
 #define __GETDENTS __old_getdents64
 #define DIRENT_TYPE struct __old_dirent64

sysdeps/unix/sysv/linux/i386/glob64.c

@@ -1 @@
-/* Two glob variants with 64-bit support, for dirent64 and __olddirent64.
-   Copyright (C) 1998-2017 Free Software Foundation, Inc.
+/* Find pathnames matching a pattern.  Linux version.
+   Copyright (C) 2017 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -16 +16 @@
    License along with the GNU C Library; if not, see
    <http://www.gnu.org/licenses/>.  */
 
-#include <dirent.h>
-#include <glob.h>
 #include <sys/stat.h>
+#include <kernel_stat.h>
 
-#define dirent dirent64
-#define __readdir(dirp) __readdir64 (dirp)
+#if !XSTAT_IS_XSTAT64
+# include <glob.h>
+# include <dirent.h>
+# include <sys/stat.h>
 
-#define glob_t glob64_t
-#define glob(pattern, flags, errfunc, pglob) \
-  __glob64 (pattern, flags, errfunc, pglob)
-#define globfree(pglob) globfree64 (pglob)
-
-#undef stat
-#define stat stat64
-#undef __stat
-#define __stat(file, buf) __xstat64 (_STAT_VER, file, buf)
+# define dirent dirent64
+# define __readdir(dirp) __readdir64 (dirp)
 
-#define NO_GLOB_PATTERN_P 1
+# define glob_t glob64_t
+# define glob(pattern, flags, errfunc, pglob) \
+  __glob64 (pattern, flags, errfunc, pglob)
+# define globfree(pglob) globfree64 (pglob)
 
-#define COMPILE_GLOB64  1
+# undef stat
+# define stat stat64
 
-#include <posix/glob.c>
+# define COMPILE_GLOB64 1
 
-#include "shlib-compat.h"
+# include <posix/glob.c>
 
-libc_hidden_def (globfree64)
+# include "shlib-compat.h"
 
+# ifdef GLOB_NO_OLD_VERSION
+strong_alias (__glob64, glob64)
+libc_hidden_def (glob64)
+# else
 versioned_symbol (libc, __glob64, glob64, GLIBC_2_2);
 libc_hidden_ver (__glob64, glob64)
-
-#if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2)
-
-#include <sysdeps/unix/sysv/linux/i386/olddirent.h>
-
-int __old_glob64 (const char *__pattern, int __flags,
-                  int (*__errfunc) (const char *, int),
-                  glob64_t *__pglob);
-
-#undef dirent
-#define dirent __old_dirent64
-#undef GL_READDIR
-# define GL_READDIR(pglob, stream) \
-  ((struct __old_dirent64 *) (pglob)->gl_readdir (stream))
-#undef __readdir
-#define __readdir(dirp) __old_readdir64 (dirp)
-#undef glob
-#define glob(pattern, flags, errfunc, pglob) \
-  __old_glob64 (pattern, flags, errfunc, pglob)
-#define convert_dirent __old_convert_dirent
-#define glob_in_dir __old_glob_in_dir
-#define GLOB_ATTRIBUTE attribute_compat_text_section
-
-#define GLOB_ONLY_P 1
-
-#include <posix/glob.c>
-
-compat_symbol (libc, __old_glob64, glob64, GLIBC_2_1);
-#endif
+# endif
+#endif /* XSTAT_IS_XSTAT64  */

sysdeps/unix/sysv/linux/i386/readdir64.c

@@ -31 +31 @@
 
 #if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2)
 
-#include <sysdeps/unix/sysv/linux/i386/olddirent.h>
+#include <olddirent.h>
 
 #define __READDIR attribute_compat_text_section __old_readdir64
 #define __GETDENTS __old_getdents64

sysdeps/unix/sysv/linux/i386/readdir64_r.c

@@ -31 +31 @@
 
 #if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2)
 
-#include <sysdeps/unix/sysv/linux/i386/olddirent.h>
+#include <olddirent.h>
 
 #define __READDIR_R attribute_compat_text_section __old_readdir64_r
 #define __GETDENTS __old_getdents64

sysdeps/unix/sysv/linux/i386/versionsort64.c

@@ -30 +30 @@
 
 #if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2)
 
-#include <sysdeps/unix/sysv/linux/i386/olddirent.h>
+#include <olddirent.h>
 
 int
 __old_versionsort64 (const struct __old_dirent64 **a,

sysdeps/unix/sysv/linux/m68k/glob64.c

@@ -1 @@
-#include <sysdeps/unix/sysv/linux/i386/glob64.c>

sysdeps/unix/sysv/linux/mips/mips64/n64/glob64.c

@@ -1 @@
-/* glob64 is in glob.c */

sysdeps/unix/sysv/linux/oldglob.c

@@ +1 @@
+#include <shlib-compat.h>
+
+#if SHLIB_COMPAT(libc, GLIBC_2_1, GLIBC_2_2) \
+    && !defined(GLOB_NO_OLD_VERSION)
+
+#include <dirent.h>
+#include <glob.h>
+#include <sys/stat.h>
+
+#include <olddirent.h>
+
+int __old_glob64 (const char *__pattern, int __flags,
+                  int (*__errfunc) (const char *, int),
+                  glob64_t *__pglob);
+libc_hidden_proto (__old_glob64);
+
+#define dirent __old_dirent64
+#define GL_READDIR(pglob, stream) \
+  ((struct __old_dirent64 *) (pglob)->gl_readdir (stream))
+#undef __readdir
+#define __readdir(dirp) __old_readdir64 (dirp)
+
+#define glob_t glob64_t
+#define glob(pattern, flags, errfunc, pglob) \
+  __old_glob64 (pattern, flags, errfunc, pglob)
+#define globfree(pglob) globfree64(pglob)
+
+#define convert_dirent __old_convert_dirent
+#define glob_in_dir __old_glob_in_dir
+
+#undef stat
+#define stat stat64
+#undef __stat
+#define __stat(file, buf) __xstat64 (_STAT_VER, file, buf)
+
+#define GLOB_ATTRIBUTE attribute_compat_text_section
+
+#include <posix/glob.c>
+
+libc_hidden_def (__old_glob64);
+
+compat_symbol (libc, __old_glob64, glob64, GLIBC_2_1);
+#endif

sysdeps/unix/sysv/linux/powerpc/powerpc32/glob64.c

@@ -1 @@
-#include <sysdeps/unix/sysv/linux/i386/glob64.c>

sysdeps/unix/sysv/linux/s390/s390-32/glob64.c

@@ +1 @@
+#define GLOB_NO_OLD_VERSION
+#include <sysdeps/unix/sysv/linux/glob64.c>

sysdeps/unix/sysv/linux/s390/s390-32/oldglob.c

@@ +1 @@
+#define GLOB_NO_OLD_VERSION
+#include <sysdeps/unix/sysv/linux/oldglob.c>

sysdeps/unix/sysv/linux/sparc/sparc32/glob64.c

@@ -1 @@
-#include <sysdeps/unix/sysv/linux/i386/glob64.c>

sysdeps/unix/sysv/linux/wordsize-64/glob64.c

@@ -1 @@
-/* This file is here so sysdeps/gnu/glob64.c doesn't take precedence.  */
-#include <sysdeps/wordsize-64/glob64.c>

sysdeps/unix/sysv/linux/x86_64/x32/glob.c

@@ -1 @@
-#include <sysdeps/wordsize-64/glob.c>

sysdeps/wordsize-64/glob.c

@@ -1 @@
-#define glob64 __no_glob64_decl
-#define globfree64 __no_globfree64_decl
-#include <posix/glob.c>
-#undef glob64
-#undef globfree64
-weak_alias (glob, glob64)
-weak_alias (globfree, globfree64)
-libc_hidden_ver (globfree, globfree64)

sysdeps/wordsize-64/glob64.c

@@ -1 @@
-/* glob64 is in glob.c */