···11+commit c87db3fcbdf890990b44d956621763538c878cd3
22+Author: Florian Weimer <fweimer@redhat.com>
33+Date: Wed May 4 12:09:35 2016 +0200
44+55+ CVE-2016-1234: glob: Do not copy d_name field of struct dirent [BZ #19779]
66+77+ Instead, we store the data we need from the return value of
88+ readdir in an object of the new type struct readdir_result.
99+ This type is independent of the layout of struct dirent.
1010+1111+ (cherry picked from commit 5171f3079f2cc53e0548fc4967361f4d1ce9d7ea)
1212+1313+diff --git a/posix/bug-glob2.c b/posix/bug-glob2.c
1414+index 0fdc5d0..5873e08 100644
1515+--- a/posix/bug-glob2.c
1616++++ b/posix/bug-glob2.c
1717+@@ -40,6 +40,17 @@
1818+ # define PRINTF(fmt, args...)
1919+ #endif
2020+2121++#define LONG_NAME \
2222++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
2323++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
2424++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
2525++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
2626++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
2727++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
2828++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
2929++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
3030++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
3131++ "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
3232+3333+ static struct
3434+ {
3535+@@ -58,6 +69,7 @@ static struct
3636+ { ".", 3, DT_DIR, 0755 },
3737+ { "..", 3, DT_DIR, 0755 },
3838+ { "a", 3, DT_REG, 0644 },
3939++ { LONG_NAME, 3, DT_REG, 0644 },
4040+ { "unreadable", 2, DT_DIR, 0111 },
4141+ { ".", 3, DT_DIR, 0111 },
4242+ { "..", 3, DT_DIR, 0755 },
4343+@@ -75,7 +87,7 @@ typedef struct
4444+ int level;
4545+ int idx;
4646+ struct dirent d;
4747+- char room_for_dirent[NAME_MAX];
4848++ char room_for_dirent[sizeof (LONG_NAME)];
4949+ } my_DIR;
5050+5151+5252+diff --git a/posix/glob.c b/posix/glob.c
5353+index 9ae76ac..ea4b0b6 100644
5454+--- a/posix/glob.c
5555++++ b/posix/glob.c
5656+@@ -24,7 +24,9 @@
5757+ #include <errno.h>
5858+ #include <sys/types.h>
5959+ #include <sys/stat.h>
6060++#include <stdbool.h>
6161+ #include <stddef.h>
6262++#include <stdint.h>
6363+6464+ /* Outcomment the following line for production quality code. */
6565+ /* #define NDEBUG 1 */
6666+@@ -73,69 +75,8 @@
6767+ # endif /* HAVE_VMSDIR_H */
6868+ #endif
6969+7070+-
7171+-/* When used in the GNU libc the symbol _DIRENT_HAVE_D_TYPE is available
7272+- if the `d_type' member for `struct dirent' is available.
7373+- HAVE_STRUCT_DIRENT_D_TYPE plays the same role in GNULIB. */
7474+-#if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
7575+-/* True if the directory entry D must be of type T. */
7676+-# define DIRENT_MUST_BE(d, t) ((d)->d_type == (t))
7777+-
7878+-/* True if the directory entry D might be a symbolic link. */
7979+-# define DIRENT_MIGHT_BE_SYMLINK(d) \
8080+- ((d)->d_type == DT_UNKNOWN || (d)->d_type == DT_LNK)
8181+-
8282+-/* True if the directory entry D might be a directory. */
8383+-# define DIRENT_MIGHT_BE_DIR(d) \
8484+- ((d)->d_type == DT_DIR || DIRENT_MIGHT_BE_SYMLINK (d))
8585+-
8686+-#else /* !HAVE_D_TYPE */
8787+-# define DIRENT_MUST_BE(d, t) false
8888+-# define DIRENT_MIGHT_BE_SYMLINK(d) true
8989+-# define DIRENT_MIGHT_BE_DIR(d) true
9090+-#endif /* HAVE_D_TYPE */
9191+-
9292+-/* If the system has the `struct dirent64' type we use it internally. */
9393+-#if defined _LIBC && !defined COMPILE_GLOB64
9494+-
9595+-# if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
9696+-# define CONVERT_D_INO(d64, d32)
9797+-# else
9898+-# define CONVERT_D_INO(d64, d32) \
9999+- (d64)->d_ino = (d32)->d_ino;
100100+-# endif
101101+-
102102+-# ifdef _DIRENT_HAVE_D_TYPE
103103+-# define CONVERT_D_TYPE(d64, d32) \
104104+- (d64)->d_type = (d32)->d_type;
105105+-# else
106106+-# define CONVERT_D_TYPE(d64, d32)
107107+-# endif
108108+-
109109+-# define CONVERT_DIRENT_DIRENT64(d64, d32) \
110110+- strcpy ((d64)->d_name, (d32)->d_name); \
111111+- CONVERT_D_INO (d64, d32) \
112112+- CONVERT_D_TYPE (d64, d32)
113113+-#endif
114114+-
115115+-
116116+-#if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
117117+-/* Posix does not require that the d_ino field be present, and some
118118+- systems do not provide it. */
119119+-# define REAL_DIR_ENTRY(dp) 1
120120+-#else
121121+-# define REAL_DIR_ENTRY(dp) (dp->d_ino != 0)
122122+-#endif /* POSIX */
123123+-
124124+ #include <stdlib.h>
125125+ #include <string.h>
126126+-
127127+-/* NAME_MAX is usually defined in <dirent.h> or <limits.h>. */
128128+-#include <limits.h>
129129+-#ifndef NAME_MAX
130130+-# define NAME_MAX (sizeof (((struct dirent *) 0)->d_name))
131131+-#endif
132132+-
133133+ #include <alloca.h>
134134+135135+ #ifdef _LIBC
136136+@@ -180,8 +121,111 @@
137137+138138+ static const char *next_brace_sub (const char *begin, int flags) __THROWNL;
139139+140140++/* A representation of a directory entry which does not depend on the
141141++ layout of struct dirent, or the size of ino_t. */
142142++struct readdir_result
143143++{
144144++ const char *name;
145145++# if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
146146++ uint8_t type;
147147++# endif
148148++ bool skip_entry;
149149++};
150150++
151151++# if defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE
152152++/* Initializer based on the d_type member of struct dirent. */
153153++# define D_TYPE_TO_RESULT(source) (source)->d_type,
154154++
155155++/* True if the directory entry D might be a symbolic link. */
156156++static bool
157157++readdir_result_might_be_symlink (struct readdir_result d)
158158++{
159159++ return d.type == DT_UNKNOWN || d.type == DT_LNK;
160160++}
161161++
162162++/* True if the directory entry D might be a directory. */
163163++static bool
164164++readdir_result_might_be_dir (struct readdir_result d)
165165++{
166166++ return d.type == DT_DIR || readdir_result_might_be_symlink (d);
167167++}
168168++# else /* defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE */
169169++# define D_TYPE_TO_RESULT(source)
170170++
171171++/* If we do not have type information, symbolic links and directories
172172++ are always a possibility. */
173173++
174174++static bool
175175++readdir_result_might_be_symlink (struct readdir_result d)
176176++{
177177++ return true;
178178++}
179179++
180180++static bool
181181++readdir_result_might_be_dir (struct readdir_result d)
182182++{
183183++ return true;
184184++}
185185++
186186++# endif /* defined _DIRENT_HAVE_D_TYPE || defined HAVE_STRUCT_DIRENT_D_TYPE */
187187++
188188++# if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
189189++/* Initializer for skip_entry. POSIX does not require that the d_ino
190190++ field be present, and some systems do not provide it. */
191191++# define D_INO_TO_RESULT(source) false,
192192++# else
193193++# define D_INO_TO_RESULT(source) (source)->d_ino == 0,
194194++# endif
195195++
196196++/* Construct an initializer for a struct readdir_result object from a
197197++ struct dirent *. No copy of the name is made. */
198198++#define READDIR_RESULT_INITIALIZER(source) \
199199++ { \
200200++ source->d_name, \
201201++ D_TYPE_TO_RESULT (source) \
202202++ D_INO_TO_RESULT (source) \
203203++ }
204204++
205205+ #endif /* !defined _LIBC || !defined GLOB_ONLY_P */
206206+207207++/* Call gl_readdir on STREAM. This macro can be overridden to reduce
208208++ type safety if an old interface version needs to be supported. */
209209++#ifndef GL_READDIR
210210++# define GL_READDIR(pglob, stream) ((pglob)->gl_readdir (stream))
211211++#endif
212212++
213213++/* Extract name and type from directory entry. No copy of the name is
214214++ made. If SOURCE is NULL, result name is NULL. Keep in sync with
215215++ convert_dirent64 below. */
216216++static struct readdir_result
217217++convert_dirent (const struct dirent *source)
218218++{
219219++ if (source == NULL)
220220++ {
221221++ struct readdir_result result = { NULL, };
222222++ return result;
223223++ }
224224++ struct readdir_result result = READDIR_RESULT_INITIALIZER (source);
225225++ return result;
226226++}
227227++
228228++#ifndef COMPILE_GLOB64
229229++/* Like convert_dirent, but works on struct dirent64 instead. Keep in
230230++ sync with convert_dirent above. */
231231++static struct readdir_result
232232++convert_dirent64 (const struct dirent64 *source)
233233++{
234234++ if (source == NULL)
235235++ {
236236++ struct readdir_result result = { NULL, };
237237++ return result;
238238++ }
239239++ struct readdir_result result = READDIR_RESULT_INITIALIZER (source);
240240++ return result;
241241++}
242242++#endif
243243++
244244++
245245+ #ifndef attribute_hidden
246246+ # define attribute_hidden
247247+ #endif
248248+@@ -1538,55 +1582,36 @@ glob_in_dir (const char *pattern, const char *directory, int flags,
249249+250250+ while (1)
251251+ {
252252+- const char *name;
253253+-#if defined _LIBC && !defined COMPILE_GLOB64
254254+- struct dirent64 *d;
255255+- union
256256+- {
257257+- struct dirent64 d64;
258258+- char room [offsetof (struct dirent64, d_name[0])
259259+- + NAME_MAX + 1];
260260+- }
261261+- d64buf;
262262+-
263263+- if (__glibc_unlikely (flags & GLOB_ALTDIRFUNC))
264264+- {
265265+- struct dirent *d32 = (*pglob->gl_readdir) (stream);
266266+- if (d32 != NULL)
267267+- {
268268+- CONVERT_DIRENT_DIRENT64 (&d64buf.d64, d32);
269269+- d = &d64buf.d64;
270270+- }
271271+- else
272272+- d = NULL;
273273+- }
274274+- else
275275+- d = __readdir64 (stream);
276276++ struct readdir_result d;
277277++ {
278278++ if (__builtin_expect (flags & GLOB_ALTDIRFUNC, 0))
279279++ d = convert_dirent (GL_READDIR (pglob, stream));
280280++ else
281281++ {
282282++#ifdef COMPILE_GLOB64
283283++ d = convert_dirent (__readdir (stream));
284284+ #else
285285+- struct dirent *d = (__builtin_expect (flags & GLOB_ALTDIRFUNC, 0)
286286+- ? ((struct dirent *)
287287+- (*pglob->gl_readdir) (stream))
288288+- : __readdir (stream));
289289++ d = convert_dirent64 (__readdir64 (stream));
290290+ #endif
291291+- if (d == NULL)
292292++ }
293293++ }
294294++ if (d.name == NULL)
295295+ break;
296296+- if (! REAL_DIR_ENTRY (d))
297297++ if (d.skip_entry)
298298+ continue;
299299+300300+ /* If we shall match only directories use the information
301301+ provided by the dirent call if possible. */
302302+- if ((flags & GLOB_ONLYDIR) && !DIRENT_MIGHT_BE_DIR (d))
303303++ if ((flags & GLOB_ONLYDIR) && !readdir_result_might_be_dir (d))
304304+ continue;
305305+306306+- name = d->d_name;
307307+-
308308+- if (fnmatch (pattern, name, fnm_flags) == 0)
309309++ if (fnmatch (pattern, d.name, fnm_flags) == 0)
310310+ {
311311+ /* If the file we found is a symlink we have to
312312+ make sure the target file exists. */
313313+- if (!DIRENT_MIGHT_BE_SYMLINK (d)
314314+- || link_exists_p (dfd, directory, dirlen, name, pglob,
315315+- flags))
316316++ if (!readdir_result_might_be_symlink (d)
317317++ || link_exists_p (dfd, directory, dirlen, d.name,
318318++ pglob, flags))
319319+ {
320320+ if (cur == names->count)
321321+ {
322322+@@ -1606,7 +1631,7 @@ glob_in_dir (const char *pattern, const char *directory, int flags,
323323+ names = newnames;
324324+ cur = 0;
325325+ }
326326+- names->name[cur] = strdup (d->d_name);
327327++ names->name[cur] = strdup (d.name);
328328+ if (names->name[cur] == NULL)
329329+ goto memory_error;
330330+ ++cur;
331331+diff --git a/sysdeps/unix/sysv/linux/i386/glob64.c b/sysdeps/unix/sysv/linux/i386/glob64.c
332332+index b4fcd1a..802c957 100644
333333+--- a/sysdeps/unix/sysv/linux/i386/glob64.c
334334++++ b/sysdeps/unix/sysv/linux/i386/glob64.c
335335+@@ -1,3 +1,21 @@
336336++/* Two glob variants with 64-bit support, for dirent64 and __olddirent64.
337337++ Copyright (C) 1998-2016 Free Software Foundation, Inc.
338338++ This file is part of the GNU C Library.
339339++
340340++ The GNU C Library is free software; you can redistribute it and/or
341341++ modify it under the terms of the GNU Lesser General Public
342342++ License as published by the Free Software Foundation; either
343343++ version 2.1 of the License, or (at your option) any later version.
344344++
345345++ The GNU C Library is distributed in the hope that it will be useful,
346346++ but WITHOUT ANY WARRANTY; without even the implied warranty of
347347++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
348348++ Lesser General Public License for more details.
349349++
350350++ You should have received a copy of the GNU Lesser General Public
351351++ License along with the GNU C Library; if not, see
352352++ <http://www.gnu.org/licenses/>. */
353353++
354354+ #include <dirent.h>
355355+ #include <glob.h>
356356+ #include <sys/stat.h>
357357+@@ -38,11 +56,15 @@ int __old_glob64 (const char *__pattern, int __flags,
358358+359359+ #undef dirent
360360+ #define dirent __old_dirent64
361361++#undef GL_READDIR
362362++# define GL_READDIR(pglob, stream) \
363363++ ((struct __old_dirent64 *) (pglob)->gl_readdir (stream))
364364+ #undef __readdir
365365+ #define __readdir(dirp) __old_readdir64 (dirp)
366366+ #undef glob
367367+ #define glob(pattern, flags, errfunc, pglob) \
368368+ __old_glob64 (pattern, flags, errfunc, pglob)
369369++#define convert_dirent __old_convert_dirent
370370+ #define glob_in_dir __old_glob_in_dir
371371+ #define GLOB_ATTRIBUTE attribute_compat_text_section
372372+
···11+commit 68302147ee061c69eb447e243ad9a18ef4cfbc4c
22+Author: Florian Weimer <fweimer@redhat.com>
33+Date: Fri Apr 29 09:33:07 2016 +0200
44+55+ glob: Simplify the interface for the GLOB_ALTDIRFUNC callback gl_readdir
66+77+ Previously, application code had to set up the d_namlen member if
88+ the target supported it, involving conditional compilation. After
99+ this change, glob will use the length of the string in d_name instead
1010+ of d_namlen to determine the file name length. All glibc targets
1111+ provide the d_type and d_ino members, and setting them as needed for
1212+ gl_readdir is straightforward.
1313+1414+ Changing the behavior with regards to d_ino is left to a future
1515+ cleanup.
1616+1717+ (cherry picked from commit 137fe72eca6923a00381a3ca9f0e7672c1f85e3f)
1818+1919+diff --git a/manual/examples/mkdirent.c b/manual/examples/mkdirent.c
2020+new file mode 100644
2121+index 0000000..f8400f4
2222+--- /dev/null
2323++++ b/manual/examples/mkdirent.c
2424+@@ -0,0 +1,42 @@
2525++/* Example for creating a struct dirent object for use with glob.
2626++ Copyright (C) 2016 Free Software Foundation, Inc.
2727++
2828++ This program is free software; you can redistribute it and/or
2929++ modify it under the terms of the GNU General Public License
3030++ as published by the Free Software Foundation; either version 2
3131++ of the License, or (at your option) any later version.
3232++
3333++ This program is distributed in the hope that it will be useful,
3434++ but WITHOUT ANY WARRANTY; without even the implied warranty of
3535++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
3636++ GNU General Public License for more details.
3737++
3838++ You should have received a copy of the GNU General Public License
3939++ along with this program; if not, if not, see <http://www.gnu.org/licenses/>.
4040++*/
4141++
4242++#include <dirent.h>
4343++#include <errno.h>
4444++#include <stddef.h>
4545++#include <stdlib.h>
4646++#include <string.h>
4747++
4848++struct dirent *
4949++mkdirent (const char *name)
5050++{
5151++ size_t dirent_size = offsetof (struct dirent, d_name) + 1;
5252++ size_t name_length = strlen (name);
5353++ size_t total_size = dirent_size + name_length;
5454++ if (total_size < dirent_size)
5555++ {
5656++ errno = ENOMEM;
5757++ return NULL;
5858++ }
5959++ struct dirent *result = malloc (total_size);
6060++ if (result == NULL)
6161++ return NULL;
6262++ result->d_type = DT_UNKNOWN;
6363++ result->d_ino = 1; /* Do not skip this entry. */
6464++ memcpy (result->d_name, name, name_length + 1);
6565++ return result;
6666++}
6767+diff --git a/manual/pattern.texi b/manual/pattern.texi
6868+index d1b9275..565e7eb 100644
6969+--- a/manual/pattern.texi
7070++++ b/manual/pattern.texi
7171+@@ -237,7 +237,44 @@ function used to read the contents of a directory. It is used if the
7272+ @code{GLOB_ALTDIRFUNC} bit is set in the flag parameter. The type of
7373+ this field is @w{@code{struct dirent *(*) (void *)}}.
7474+7575+-This is a GNU extension.
7676++An implementation of @code{gl_readdir} needs to initialize the following
7777++members of the @code{struct dirent} object:
7878++
7979++@table @code
8080++@item d_type
8181++This member should be set to the file type of the entry if it is known.
8282++Otherwise, the value @code{DT_UNKNOWN} can be used. The @code{glob}
8383++function may use the specified file type to avoid callbacks in cases
8484++where the file type indicates that the data is not required.
8585++
8686++@item d_ino
8787++This member needs to be non-zero, otherwise @code{glob} may skip the
8888++current entry and call the @code{gl_readdir} callback function again to
8989++retrieve another entry.
9090++
9191++@item d_name
9292++This member must be set to the name of the entry. It must be
9393++null-terminated.
9494++@end table
9595++
9696++The example below shows how to allocate a @code{struct dirent} object
9797++containing a given name.
9898++
9999++@smallexample
100100++@include mkdirent.c.texi
101101++@end smallexample
102102++
103103++The @code{glob} function reads the @code{struct dirent} members listed
104104++above and makes a copy of the file name in the @code{d_name} member
105105++immediately after the @code{gl_readdir} callback function returns.
106106++Future invocations of any of the callback functions may dealloacte or
107107++reuse the buffer. It is the responsibility of the caller of the
108108++@code{glob} function to allocate and deallocate the buffer, around the
109109++call to @code{glob} or using the callback functions. For example, an
110110++application could allocate the buffer in the @code{gl_readdir} callback
111111++function, and deallocate it in the @code{gl_closedir} callback function.
112112++
113113++The @code{gl_readdir} member is a GNU extension.
114114+115115+ @item gl_opendir
116116+ The address of an alternative implementation of the @code{opendir}
117117+diff --git a/posix/bug-glob2.c b/posix/bug-glob2.c
118118+index ddf5ec9..0fdc5d0 100644
119119+--- a/posix/bug-glob2.c
120120++++ b/posix/bug-glob2.c
121121+@@ -193,7 +193,7 @@ my_readdir (void *gdir)
122122+ return NULL;
123123+ }
124124+125125+- dir->d.d_ino = dir->idx;
126126++ dir->d.d_ino = 1; /* glob should not skip this entry. */
127127+128128+ #ifdef _DIRENT_HAVE_D_TYPE
129129+ dir->d.d_type = filesystem[dir->idx].type;
130130+diff --git a/posix/glob.c b/posix/glob.c
131131+index 0c04c3c..9ae76ac 100644
132132+--- a/posix/glob.c
133133++++ b/posix/glob.c
134134+@@ -57,10 +57,8 @@
135135+136136+ #if defined HAVE_DIRENT_H || defined __GNU_LIBRARY__
137137+ # include <dirent.h>
138138+-# define NAMLEN(dirent) strlen((dirent)->d_name)
139139+ #else
140140+ # define dirent direct
141141+-# define NAMLEN(dirent) (dirent)->d_namlen
142142+ # ifdef HAVE_SYS_NDIR_H
143143+ # include <sys/ndir.h>
144144+ # endif
145145+@@ -76,12 +74,6 @@
146146+ #endif
147147+148148+149149+-/* In GNU systems, <dirent.h> defines this macro for us. */
150150+-#ifdef _D_NAMLEN
151151+-# undef NAMLEN
152152+-# define NAMLEN(d) _D_NAMLEN(d)
153153+-#endif
154154+-
155155+ /* When used in the GNU libc the symbol _DIRENT_HAVE_D_TYPE is available
156156+ if the `d_type' member for `struct dirent' is available.
157157+ HAVE_STRUCT_DIRENT_D_TYPE plays the same role in GNULIB. */
158158+@@ -105,12 +97,6 @@
159159+160160+ /* If the system has the `struct dirent64' type we use it internally. */
161161+ #if defined _LIBC && !defined COMPILE_GLOB64
162162+-# if defined HAVE_DIRENT_H || defined __GNU_LIBRARY__
163163+-# define CONVERT_D_NAMLEN(d64, d32)
164164+-# else
165165+-# define CONVERT_D_NAMLEN(d64, d32) \
166166+- (d64)->d_namlen = (d32)->d_namlen;
167167+-# endif
168168+169169+ # if (defined POSIX || defined WINDOWS32) && !defined __GNU_LIBRARY__
170170+ # define CONVERT_D_INO(d64, d32)
171171+@@ -127,8 +113,7 @@
172172+ # endif
173173+174174+ # define CONVERT_DIRENT_DIRENT64(d64, d32) \
175175+- memcpy ((d64)->d_name, (d32)->d_name, NAMLEN (d32) + 1); \
176176+- CONVERT_D_NAMLEN (d64, d32) \
177177++ strcpy ((d64)->d_name, (d32)->d_name); \
178178+ CONVERT_D_INO (d64, d32) \
179179+ CONVERT_D_TYPE (d64, d32)
180180+ #endif
181181+@@ -1554,7 +1539,6 @@ glob_in_dir (const char *pattern, const char *directory, int flags,
182182+ while (1)
183183+ {
184184+ const char *name;
185185+- size_t len;
186186+ #if defined _LIBC && !defined COMPILE_GLOB64
187187+ struct dirent64 *d;
188188+ union
189189+@@ -1622,12 +1606,10 @@ glob_in_dir (const char *pattern, const char *directory, int flags,
190190+ names = newnames;
191191+ cur = 0;
192192+ }
193193+- len = NAMLEN (d);
194194+- names->name[cur] = (char *) malloc (len + 1);
195195++ names->name[cur] = strdup (d->d_name);
196196+ if (names->name[cur] == NULL)
197197+ goto memory_error;
198198+- *((char *) mempcpy (names->name[cur++], name, len))
199199+- = '\0';
200200++ ++cur;
201201+ ++nfound;
202202+ }
203203+ }
204204+diff --git a/posix/tst-gnuglob.c b/posix/tst-gnuglob.c
205205+index 992b997..b7b859b 100644
206206+--- a/posix/tst-gnuglob.c
207207++++ b/posix/tst-gnuglob.c
208208+@@ -211,7 +211,7 @@ my_readdir (void *gdir)
209209+ return NULL;
210210+ }
211211+212212+- dir->d.d_ino = dir->idx;
213213++ dir->d.d_ino = 1; /* glob should not skip this entry. */
214214+215215+ #ifdef _DIRENT_HAVE_D_TYPE
216216+ dir->d.d_type = filesystem[dir->idx].type;