]> git.ipfire.org Git - thirdparty/shadow.git/commit
src/vipw.c: Use string literals to initialize 'Prog'
authorAlejandro Colomar <alx@kernel.org>
Thu, 7 Mar 2024 22:38:48 +0000 (23:38 +0100)
committerSerge Hallyn <serge@hallyn.com>
Fri, 8 Mar 2024 16:24:15 +0000 (10:24 -0600)
commit89c4da43cbe8cfbbd949f523944343391c5302a2
treec0f2958f89f463ab6a98675755d9b52c5bbf882d
parent0ab893a734b140a8e7ea65b20ec65b08bb95d4fe
src/vipw.c: Use string literals to initialize 'Prog'

This avoids using argv[0], which is controlled by the user,
and might inject arbitrary text in stderr and the logs.

Link: <https://github.com/shadow-maint/shadow/issues/959>
Link: <https://github.com/shadow-maint/shadow/pull/960>
Cc: "Skyler Ferrante (RIT Student)" <sjf5462@rit.edu>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Karel Zak <kzak@redhat.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Christian Brauner <christian@brauner.io>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
src/vipw.c