lib/60517: fnmatch(2) does not implement FNM_PATHNAME correctly

["drew%ddevault.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60517
>Category:       lib
>Synopsis:       fnmatch(2) does not implement FNM_PATHNAME correctly
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jul 29 17:35:00 +0000 2026
>Originator:     Drew DeVault
>Release:        NetBSD 11.0-rc7
>Organization:
>Environment:
NetBSD kludge 11.0_RC7 NetBSD 11.0_RC7 (GENERIC) #0: Wed Jul 22 05:26:24 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64 Intel 686-class NetBSD

>Description:
fnmatch(3) does not implement FNM_PATHNAME correctly in rangematch, causing some patterns to not match correctly.
>How-To-Repeat:
The following program reproduces the issue:

#include <fnmatch.h>
#include <stdio.h>

int main(int argc, char *argv[]) {
	int match = fnmatch(argv[1], argv[2], 0);
	printf("%d\n", match);
	return 0;
}

Run:

./fnmatch '[\\/$]*' '/usr/lib'

And it should print 0.
>Fix:
--- src.orig/lib/libc/gen/fnmatch.c	2014-10-13 00:32:33.000000000 +0200
+++ src/lib/libc/gen/fnmatch.c	2026-07-29 15:25:45.271817024 +0200
@@ -91,7 +91,7 @@
 	need = 1;
 	for (ok = 0; (c = FOLDCASE(*pattern++, flags)) != ']' || need;) {
 		need = 0;
-		if (c == '/')
+		if (c == '/' && (flags & FNM_PATHNAME))
 			return (void *)-1;
 		if (c == '\\' && !(flags & FNM_NOESCAPE))
 			c = FOLDCASE(*pattern++, flags);
--- src.orig/tests/lib/libc/gen/t_fnmatch.c	2016-10-31 06:08:53.000000000 +0100
+++ src/tests/lib/libc/gen/t_fnmatch.c	2026-07-29 19:25:10.723264988 +0200
@@ -125,6 +125,8 @@
 	ATF_CHECK(fnmatch("???x", "xxxx", FNM_PATHNAME) == 0);
 	ATF_CHECK(fnmatch("*/xxx", "/xxx", FNM_PATHNAME) == 0);
 	ATF_CHECK(fnmatch("x/*.y", "x/z.y", FNM_PATHNAME) == 0);
+
+	ATF_CHECK(fnmatch("[\\\\/$]*", "/usr/lib", 0) == 0);
 }