hwdb: reject overlong fnmatch key instead of passing NULL to fnmatch()

Browse Source

When the accumulated trie key exceeds the fixed-size line buffer,
linebuf_get() returns NULL. trie_fnmatch_f() passed that NULL straight
into fnmatch() as the pattern, causing a SIGSEGV on a crafted hwdb.bin
(reachable now that recursion is capped rather than overflowing the
stack first). Treat the NULL like the other corruption checks and
return -EBADMSG.

Follow-up for 73fea38cf1

Fixes https://github.com/systemd/systemd/issues/42376

Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>

...

This commit is contained in:

Luca Boccassi

2026-05-29 17:21:31 +01:00

parent 6ec161c5b9

commit 3db89cbf0e

2 changed files with 12 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

test/fuzz/fuzz-hwdb/overlong-fnmatch-key

BIN

Binary file not shown.