[Bug glob/34453] New: glob: Stack overflow with many wildcard directory components

https://sourceware.org/bugzilla/show_bug.cgi?id=3D34453

            Bug ID: 34453
           Summary: glob: Stack overflow with many wildcard directory
                    components
           Product: glibc
           Version: 2.44
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: glob
          Assignee: unassigned at sourceware dot org
          Reporter: sanghyun.park.cnu at gmail dot com
  Target Milestone: ---

Created attachment 16885
  --> https://sourceware.org/bugzilla/attachment.cgi?id=3D16885&action=3Ded=
it
The poc and ASAN report of glob stack-buffer-overflow

Hello, while performing fuzzing, I found a stack-overflow vulnerability in
glibc
glob.

Overview
--------

In posix/glob.c, __glob splits the pattern at the rightmost slash and
recursively calls __glob(dirname, ...) when the directory portion contains
metacharacters. A wildcard in every directory component therefore creates
one live __glob frame per component. Each frame also keeps a progressively
shorter dirname copy on the stack, so a sufficiently deep pattern overflows
the stack before the leading nonexistent directory can produce GLOB_NOMATCH.

No exact duplicate was found. Similar bugs are BZ #24607, BZ #30635, and
BZ #33537.

Affected versions
-----------------

The affected range is:

glibc 1.09 through glibc 2.44, plus current main (2.44.9000)

Reproduction with ASAN
----------------------

Use the attached glibc_glob_wildcard_depth_poc.c.

Build glibc 2.44:

```
git clone https://sourceware.org/git/glibc.git glibc-src
git -C glibc-src checkout glibc-2.44
mkdir glibc-build
cd glibc-build

CFLAGS=3D'-O1 -g3 -fno-omit-frame-pointer' \
../glibc-src/configure --prefix=3D/usr --disable-werror
make -j"$(getconf _NPROCESSORS_ONLN)"
cd ..
```

Compile the attached PoC with ASAN and run it through glibc 2.44:

```
cc -std=3Dc11 -O1 -g3 -Wall -Wextra -Werror \
-fsanitize=3Daddress -fno-omit-frame-pointer \
glibc_glob_wildcard_depth_poc.c \
-o /tmp/glibc-glob-wildcard-depth-asan

ASAN_OPTIONS=3D'abort_on_error=3D1:detect_leaks=3D0:symbolize=3D1' \
glibc-build/testrun.sh \
/tmp/glibc-glob-wildcard-depth-asan 200 256
```

ASAN reports stack-overflow in __glob; the trace repeatedly reaches
posix/glob.c:1003. The complete output is attached as asan-glibc-2.44.log.

--=20
You are receiving this mail because:
You are on the CC list for the bug.=