From 855d15a04625818fa28a94e693dd4dc7acfb5af3 Mon Sep 17 00:00:00 2001 From: Alejandro Colomar Date: Tue, 14 Jul 2026 14:40:43 +0200 Subject: [PATCH] lib/getdef.c: def_load(): Don't handle '"' specially That handling of '"' in login.defs(5) is undocumented, and doesn't seem very robust: name "this value"string The line above will be taken as if the value was 'this value', with the remainder completely ignored. Another weird case is: name value"string where the value is 'value'. Since this is undocumented, brittle, and most likely not used, let's remove it entirely. After all, it's entirely useless. The following entry name value string is interpreted as having a value of 'value string', as one would expect. The quotations don't provide absolutely any value (they don't serve to escape any characters) at all, and seem dangerous instead. Fixes: 45c6603cc86c (2007-10-07; "[svn-upgrade] Integrating new upstream version, shadow (19990709)") Closes: Reviewed-by: Iker Pedrosa Signed-off-by: Alejandro Colomar --- lib/getdef.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/getdef.c b/lib/getdef.c index 4616b65ef..113397f85 100644 --- a/lib/getdef.c +++ b/lib/getdef.c @@ -574,8 +574,7 @@ static void def_load (void) if (s == NULL) continue; /* only 1 field?? */ - value = stpspn(s, " \"\t"); /* next nonwhite */ - stpsep(value, "\""); + value = stpspn(s, " \t"); /* * Store the value in def_table. -- 2.47.3