Re: buffer overrun in fnmatch.c

[Todd C. Miller]

The problem is that classmatch() can change pattern so we need to
check to see if it was consumed afterwards.

 - todd

Index: lib/libc/gen/fnmatch.c
===================================================================
RCS file: /cvs/src/lib/libc/gen/fnmatch.c,v
retrieving revision 1.18
diff -u -p -u -r1.18 fnmatch.c
--- lib/libc/gen/fnmatch.c      11 Dec 2014 16:25:34 -0000      1.18
+++ lib/libc/gen/fnmatch.c      31 Jul 2015 18:55:18 -0000
@@ -192,6 +192,7 @@ static int fnmatch_ch(const char **patte
                 result = 0;
                 continue;
             }
+            if (!**pattern) break;
 
 leadingclosebrace:
             /* Look at only well-formed range patterns;