Bug 2580 - security hole in glob.c
Summary: security hole in glob.c
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 3.0-CURRENT
Hardware: Any Any
: Normal Affects Only Me
Assignee: Warner Losh
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 1997-01-25 15:10 UTC by Julian Assange
Modified: 1997-03-23 23:32 UTC (History)
0 users

See Also:

Attachments
file.diff (1.76 KB, patch)
1997-01-25 15:10 UTC, Julian Assange 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Julian Assange 1997-01-25 15:10:00 UTC 
	the libc routine glob() calls globtilde() to expand ~.
	globtilde() will copy $HOME to the pattern buf without
	any bounds checking(!)
Comment 1 mpp freebsd_committer freebsd_triage 1997-01-26 07:09:58 UTC 
Responsible Changed
From-To: gnats-admin->freebsd-bugs

Misfiled PR.
Comment 2 Bill Fenner freebsd_committer freebsd_triage 1997-01-27 18:31:52 UTC 
Responsible Changed
From-To: freebsd-bugs->freebsd-bugs

It didn't.
Comment 3 Warner Losh freebsd_committer freebsd_triage 1997-02-09 06:40:19 UTC 
Responsible Changed
From-To: freebsd-bugs->imp

It's on my list now.
Comment 4 Warner Losh freebsd_committer freebsd_triage 1997-03-23 23:32:00 UTC 
State Changed
From-To: open->closed


Fixed in 1.7 of glob.c by a similar, but different, patch.