You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This bug occurs when the glob.Glob has a matcher which is empty and its length is 0.
In detail, the crash locates in glob/match/raw.go:(self Row) matchAll(s string) bool:
If length is 0 and s meets the end, the function won't return by the condition i < length and it will crashed at s[idx:idx+next+1]
The PoC is here:
package main
import (
"strings""github.com/gobwas/glob"
)
// IndexerGlobFromString parses a comma separated list of patterns and returns a glob.Glob slice suited for repo indexingfuncIndexerGlobFromString(globstrstring) []glob.Glob {
extarr:=make([]glob.Glob, 0, 10)
for_, expr:=rangestrings.Split(strings.ToLower(globstr), ",") {
expr=strings.TrimSpace(expr)
ifexpr!="" {
ifg, err:=glob.Compile(expr, '.', '/'); err==nil {
extarr=append(extarr, g)
}
}
}
returnextarr
}
funcmain() {
pocstr:="0{"// this string is designed to make the second matcher of g is emptyg:=IndexerGlobFromString(pocstr)[0]
// the second matcher of g is empty, and its length is 0g.Match("0")
}
This bug occurs when the glob.Glob has a matcher which is empty and its length is 0.
In detail, the crash locates in
glob/match/raw.go:(self Row) matchAll(s string) bool
:If
length
is 0 ands
meets the end, the function won't return by the conditioni < length
and it will crashed ats[idx:idx+next+1]
The PoC is here:
It will crash as:
The text was updated successfully, but these errors were encountered: