From: Tanish Yadav Date: Mon, 4 Mar 2024 19:21:41 +0000 (+0530) Subject: su: fix use after free in run_shell X-Git-Tag: v2.42-start~493 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4b2e6f5071a4c5beebbd9668d24dc05defc096d7;p=thirdparty%2Futil-linux.git su: fix use after free in run_shell Do not free tmp for non login branch as basename may return a pointer to some part of it. [kzak@redhat.com: - improve coding style of the function] Signed-off-by: Tanish Yadav Signed-off-by: Karel Zak --- diff --git a/login-utils/su-common.c b/login-utils/su-common.c index 242b6ce4e..9bc023196 100644 --- a/login-utils/su-common.c +++ b/login-utils/su-common.c @@ -835,13 +835,14 @@ static void run_shell( size_t n_args = 1 + su->fast_startup + 2 * ! !command + n_additional_args + 1; const char **args = xcalloc(n_args, sizeof *args); size_t argno = 1; + char *tmp; DBG(MISC, ul_debug("starting shell [shell=%s, command=\"%s\"%s%s]", shell, command, su->simulate_login ? " login" : "", su->fast_startup ? " fast-start" : "")); + tmp = xstrdup(shell); - char* tmp = xstrdup(shell); if (su->simulate_login) { char *arg0; char *shell_basename; @@ -851,10 +852,8 @@ static void run_shell( arg0[0] = '-'; strcpy(arg0 + 1, shell_basename); args[0] = arg0; - } else { - args[0] = basename(tmp); - } - free(tmp); + } else + args[0] = basename(tmp); if (su->fast_startup) args[argno++] = "-f";