[PATCH] trace-cmd record: Use copy of PATH for strtok_r() operations

[PATCH] trace-cmd record: Use copy of PATH for strtok_r() operations

[Steven Rostedt]

From: "Steven Rostedt (Google)" <rostedt@goodmis.org>

As strtok_r() modifies the string it is parsing, using the environment variable
PATH to find the paths for execution causes it to be truncated when reused by
exec. Instead, make a copy of the PATH environment variable to use to parse the
paths.

I had this fixed in my repo for some time and never pushed it out, but it was
eventually reported by others.

Link: https://lore.kernel.org/all/20231128192435.36507-1-void@manifault.com/

Reported-by: David Vernet <void@manifault.com>
Fixes: edf9424029cc ("trace-cmd: Open code execvp routine to avoid multiple execve syscalls")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
---
 tracecmd/trace-record.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tracecmd/trace-record.c b/tracecmd/trace-record.c
index bced8040..c424a874 100644
--- a/tracecmd/trace-record.c
+++ b/tracecmd/trace-record.c
@@ -1698,6 +1698,11 @@ static void execute_program(int argc, char **argv)
 		if (!path)
 			die("can't search for '%s' if $PATH is NULL", argv[0]);
 
+		/* Do not modify the actual environment variable */
+		path = strdup(path);
+		if (!path)
+			die("Failed to allocate PATH");
+
 		for (entry = strtok_r(path, ":", &saveptr);
 		     entry; entry = strtok_r(NULL, ":", &saveptr)) {
 
@@ -1708,6 +1713,7 @@ static void execute_program(int argc, char **argv)
 				break;
 
 		}
+		free(path);
 	} else {
 		strncpy(buf, argv[0], sizeof(buf));
 	}
-- 
2.42.0

Re: [PATCH] trace-cmd record: Use copy of PATH for strtok_r() operations

[David Vernet]

On Tue, Nov 28, 2023 at 03:30:24PM -0500, Steven Rostedt wrote:
> From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
> 
> As strtok_r() modifies the string it is parsing, using the environment variable
> PATH to find the paths for execution causes it to be truncated when reused by
> exec. Instead, make a copy of the PATH environment variable to use to parse the
> paths.
> 
> I had this fixed in my repo for some time and never pushed it out, but it was
> eventually reported by others.
> 
> Link: https://lore.kernel.org/all/20231128192435.36507-1-void@manifault.com/
> 
> Reported-by: David Vernet <void@manifault.com>
> Fixes: edf9424029cc ("trace-cmd: Open code execvp routine to avoid multiple execve syscalls")
> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Reviewed-by: David Vernet <void@manifault.com>