diff options
| author | Jonathan Lemon <jlemon@FreeBSD.org> | 2001-03-15 18:50:32 +0000 |
|---|---|---|
| committer | Jonathan Lemon <jlemon@FreeBSD.org> | 2001-03-15 18:50:32 +0000 |
| commit | 813c96dbd7dacccc81e0cb3a1ae55eb1395fc7c9 (patch) | |
| tree | 695f249bc66019fd608666ea42a21e3f15eb1d2c /lib/libc/gen | |
| parent | 2186ce6742d36bf64133fd72fce9cb0202595329 (diff) | |
| download | src-813c96dbd7dacccc81e0cb3a1ae55eb1395fc7c9.tar.gz src-813c96dbd7dacccc81e0cb3a1ae55eb1395fc7c9.zip | |
Limit the number of paths that glob can return to MAX_GLOBENTRIES, which
is currently set to 10000. This is intended to prevent glob from running
amok when a highly recursive path is provided (such as "../*/../*/../*/...")
Reviewed by: Diane Bruce <db@db.net>, jhb
Notes
Notes:
svn path=/head/; revision=74307
Diffstat (limited to 'lib/libc/gen')
| -rw-r--r-- | lib/libc/gen/glob.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/lib/libc/gen/glob.c b/lib/libc/gen/glob.c index 09dfd7a7cb54..48209cccebf4 100644 --- a/lib/libc/gen/glob.c +++ b/lib/libc/gen/glob.c @@ -32,6 +32,8 @@ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. + * + * $FreeBSD$ */ #if defined(LIBC_SCCS) && !defined(lint) @@ -78,6 +80,8 @@ static char sccsid[] = "@(#)glob.c 8.3 (Berkeley) 10/13/93"; #include "collate.h" +#define MAX_GLOBENTRIES 10000 /* limit number of entries */ + #define DOLLAR '$' #define DOT '.' #define EOS '\0' @@ -658,6 +662,9 @@ globextend(path, pglob) char *copy; const Char *p; + if (pglob->gl_pathc > MAX_GLOBENTRIES) + return (GLOB_ABEND); + newsize = sizeof(*pathv) * (2 + pglob->gl_pathc + pglob->gl_offs); pathv = pglob->gl_pathv ? realloc((char *)pglob->gl_pathv, newsize) : |