From: Michael Vetter <jubalh@iodoru.org>
Date: Mon, 20 Sep 2021 09:04:50 +0000 (+0200)
Subject: Only free sgent if it was initialized
X-Git-Tag: 4.10~35^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F417%2Fhead;p=thirdparty%2Fshadow.git

Only free sgent if it was initialized

`sgent` is only initialized in `get_group()` if `is_shadowgrp` is true.
So we should also only attempt to free it if this is actually the case.

Can otherwise lead to:
```
free() double free detected in tcache 2 (gpasswd)
```
---

diff --git a/src/gpasswd.c b/src/gpasswd.c
index a43d9a590..04bed83d6 100644
--- a/src/gpasswd.c
+++ b/src/gpasswd.c
@@ -1207,11 +1207,13 @@ int main (int argc, char **argv)
 	sssd_flush_cache (SSSD_DB_GROUP);
 
 #ifdef SHADOWGRP
-	if (sgent.sg_adm) {
-		xfree(sgent.sg_adm);
-	}
-	if (sgent.sg_mem) {
-		xfree(sgent.sg_mem);
+	if (is_shadowgrp) {
+		if (sgent.sg_adm) {
+			xfree(sgent.sg_adm);
+		}
+		if (sgent.sg_mem) {
+			xfree(sgent.sg_mem);
+		}
 	}
 #endif
 	if (grent.gr_mem) {