util-linux.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] su: fix use after free in run_shell
@ 2024-03-04 19:21 Tanish Yadav
  2024-03-05  9:15 ` Karel Zak
  0 siblings, 1 reply; 2+ messages in thread
From: Tanish Yadav @ 2024-03-04 19:21 UTC (permalink / raw)
  To: util-linux

Do not free tmp for non login branch as basename may return a pointer to
some part of it.

Signed-off-by: Tanish Yadav <devtany@gmail.com>
---
  login-utils/su-common.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/login-utils/su-common.c b/login-utils/su-common.c
index 242b6ce4e..8cb54e1c1 100644
--- a/login-utils/su-common.c
+++ b/login-utils/su-common.c
@@ -851,10 +851,10 @@ static void run_shell(
		arg0[0] = '-';
		strcpy(arg0 + 1, shell_basename);
		args[0] = arg0;
+		free(tmp);
	} else {
-    args[0] = basename(tmp);
-  }
-  free(tmp);
+		args[0] = basename(tmp);
+	}

	if (su->fast_startup)
		args[argno++] = "-f";
--
2.44.0


^ permalink raw reply related	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2024-03-05  9:15 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-04 19:21 [PATCH] su: fix use after free in run_shell Tanish Yadav
2024-03-05  9:15 ` Karel Zak

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).