]> git.ipfire.org Git - thirdparty/shadow.git/commitdiff
fix: memory leak of ngrp in src/userdel.c update_groups()
authorArtem Semenov <savoptik@altlinux.org>
Thu, 4 Jun 2026 11:04:03 +0000 (14:04 +0300)
committerAlejandro Colomar <foss+github@alejandro-colomar.es>
Thu, 6 Aug 2026 13:53:48 +0000 (15:53 +0200)
Likewise, update_groups() duplicates each regular group with __gr_dup()
and never frees the 'ngrp' copy.  Release it with gr_free(); as with
__sgr_dup(), the duplicate owns deep-copied fields, so free() alone would
leak them.

valgrind --leak-check=full --show-leak-kinds=all src/userdel -P <prefix> bob,
before this commit:

    471 (320 direct, 151 indirect) bytes in 10 blocks are definitely lost
       at 0x4848EB8: calloc
       by __gr_dup (groupmem.c:28)
       by update_groups (userdel.c:197)
    definitely lost: 800 bytes in 40 blocks

after this commit:

    definitely lost: 480 bytes in 30 blocks

Signed-off-by: Artem Semenov <savoptik@altlinux.org>
Reviewed-by: Alejandro Colomar <alx@kernel.org>
src/userdel.c

index 5e7cf38eb48fc4ebefc31827ed389b7dc2b37b5d..06b44e9e6f5b75eb866afc9c8f674aadac0ab7cc 100644 (file)
@@ -219,6 +219,7 @@ static void update_groups (bool process_selinux)
 #endif                         /* WITH_AUDIT */
                SYSLOG(LOG_INFO, "delete '%s' from group '%s'\n",
                        user_name, ngrp->gr_name);
+               gr_free (ngrp);
        }
 
        if (getdef_bool ("USERGROUPS_ENAB")) {