* [PATCH] su: fix use after free in run_shell
@ 2024-03-04 19:21 Tanish Yadav
2024-03-05 9:15 ` Karel Zak
0 siblings, 1 reply; 2+ messages in thread
From: Tanish Yadav @ 2024-03-04 19:21 UTC (permalink / raw)
To: util-linux
Do not free tmp for non login branch as basename may return a pointer to
some part of it.
Signed-off-by: Tanish Yadav <devtany@gmail.com>
---
login-utils/su-common.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/login-utils/su-common.c b/login-utils/su-common.c
index 242b6ce4e..8cb54e1c1 100644
--- a/login-utils/su-common.c
+++ b/login-utils/su-common.c
@@ -851,10 +851,10 @@ static void run_shell(
arg0[0] = '-';
strcpy(arg0 + 1, shell_basename);
args[0] = arg0;
+ free(tmp);
} else {
- args[0] = basename(tmp);
- }
- free(tmp);
+ args[0] = basename(tmp);
+ }
if (su->fast_startup)
args[argno++] = "-f";
--
2.44.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-03-05 9:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-04 19:21 [PATCH] su: fix use after free in run_shell Tanish Yadav
2024-03-05 9:15 ` Karel Zak
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).