From: Artem Semenov Date: Mon, 8 Jun 2026 11:18:59 +0000 (+0300) Subject: fix: memory leak of nsgrp in src/userdel.c update_groups() X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a69ece408382cd258c1f45134f618b013a0595a8;p=thirdparty%2Fshadow.git fix: memory leak of nsgrp in src/userdel.c update_groups() update_groups() duplicates each shadow group with __sgr_dup() to edit its member list, but never releases the copy. The 'nsgrp' struct sgrp, along with its deep-copied name, passwd and member/admin arrays, leaks once per iteration. __sgr_dup() is not malloc()-like, so free() would not release the inner allocations; use the matching sgr_free(). valgrind --leak-check=full --show-leak-kinds=all src/userdel -P bob (bob is a member of 10 groups), before this commit: 551 (320 direct, 231 indirect) bytes in 10 blocks are definitely lost at 0x4848EB8: calloc by __sgr_dup (sgroupio.c:37) by update_groups (userdel.c:255) ... definitely lost: 1,120 bytes in 50 blocks after this commit: definitely lost: 800 bytes in 40 blocks Signed-off-by: Artem Semenov Reviewed-by: Alejandro Colomar --- diff --git a/src/userdel.c b/src/userdel.c index 20f28281c..5e7cf38eb 100644 --- a/src/userdel.c +++ b/src/userdel.c @@ -279,6 +279,7 @@ static void update_groups (bool process_selinux) #endif /* WITH_AUDIT */ SYSLOG(LOG_INFO, "delete '%s' from shadow group '%s'\n", user_name, nsgrp->sg_namp); + sgr_free (nsgrp); } #endif /* SHADOWGRP */ }