[PR PATCH] util-linux: backport fix for su(1)

[PR PATCH] util-linux: backport fix for su(1)

[tanpsi]

[-- Attachment #1: Type: text/plain, Size: 1294 bytes --]

There is a new pull request by tanpsi against master on the void-packages repository

https://github.com/tanpsi/void-packages util-linux-su
https://github.com/void-linux/void-packages/pull/50686

util-linux: backport fix for su(1)
<!-- Uncomment relevant sections and delete options which are not applicable -->

#### Testing the changes
- I tested the changes in this PR: **YES**

<!--
#### New package
- This new package conforms to the [package requirements](https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#package-requirements): **YES**|**NO**
-->

<!-- Note: If the build is likely to take more than 2 hours, please add ci skip tag as described in
https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#continuous-integration
and test at least one native build and, if supported, at least one cross build.
Ignore this section if this PR is not skipping CI.
-->
#### Local build testing
- I built this PR locally for my native architecture, (x86_64-glibc)
<br>

This is a backport for the [upstream fix](https://github.com/util-linux/util-linux/commit/4b2e6f5071a4c5beebbd9668d24dc05defc096d7). It was suggested by @classabbyamp at #50538

A patch file from https://github.com/void-linux/void-packages/pull/50686.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-util-linux-su-50686.patch --]
[-- Type: text/x-diff, Size: 2836 bytes --]

From 53fc725e4e7841dc2540d7a6109792f314749973 Mon Sep 17 00:00:00 2001
From: Tanish Yadav <devtany@gmail.com>
Date: Tue, 4 Jun 2024 22:19:36 +0530
Subject: [PATCH] util-linux: su: fix use after free in run_shell

---
 .../su-fix-use-after-free-in-run_shell.patch  | 49 +++++++++++++++++++
 srcpkgs/util-linux/template                   |  2 +-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 srcpkgs/util-linux/patches/su-fix-use-after-free-in-run_shell.patch

diff --git a/srcpkgs/util-linux/patches/su-fix-use-after-free-in-run_shell.patch b/srcpkgs/util-linux/patches/su-fix-use-after-free-in-run_shell.patch
new file mode 100644
index 00000000000000..daf0f4a88b3883
--- /dev/null
+++ b/srcpkgs/util-linux/patches/su-fix-use-after-free-in-run_shell.patch
@@ -0,0 +1,49 @@
+From 4b2e6f5071a4c5beebbd9668d24dc05defc096d7 Mon Sep 17 00:00:00 2001
+From: Tanish Yadav <devtany@gmail.com>
+Date: Tue, 5 Mar 2024 00:51:41 +0530
+Subject: [PATCH] su: fix use after free in run_shell
+
+Do not free tmp for non login branch as basename may return a pointer to
+some part of it.
+
+[kzak@redhat.com: - improve coding style of the function]
+
+Signed-off-by: Tanish Yadav <devtany@gmail.com>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ login-utils/su-common.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/login-utils/su-common.c b/login-utils/su-common.c
+index 242b6ce4e..9bc023196 100644
+--- a/login-utils/su-common.c
++++ b/login-utils/su-common.c
+@@ -835,13 +835,14 @@ static void run_shell(
+ 	size_t n_args = 1 + su->fast_startup + 2 * ! !command + n_additional_args + 1;
+ 	const char **args = xcalloc(n_args, sizeof *args);
+ 	size_t argno = 1;
++	char *tmp;
+ 
+ 	DBG(MISC, ul_debug("starting shell [shell=%s, command=\"%s\"%s%s]",
+ 				shell, command,
+ 				su->simulate_login ? " login" : "",
+ 				su->fast_startup ? " fast-start" : ""));
++	tmp = xstrdup(shell);
+ 
+-  char* tmp = xstrdup(shell);
+ 	if (su->simulate_login) {
+ 		char *arg0;
+ 		char *shell_basename;
+@@ -851,10 +852,8 @@ static void run_shell(
+ 		arg0[0] = '-';
+ 		strcpy(arg0 + 1, shell_basename);
+ 		args[0] = arg0;
+-	} else {
+-    args[0] = basename(tmp);
+-  }
+-  free(tmp);
++	} else
++		args[0] = basename(tmp);
+ 
+ 	if (su->fast_startup)
+ 		args[argno++] = "-f";
diff --git a/srcpkgs/util-linux/template b/srcpkgs/util-linux/template
index 64f262c25a4a59..cbd705736f93aa 100644
--- a/srcpkgs/util-linux/template
+++ b/srcpkgs/util-linux/template
@@ -2,7 +2,7 @@
 # Keep this package sync with util-linux-common
 pkgname=util-linux
 version=2.39.3
-revision=2
+revision=3
 build_style=gnu-configure
 configure_args="--exec-prefix=\${prefix} --enable-libuuid --disable-makeinstall-chown
  --enable-libblkid --enable-fsck --disable-rpath --enable-fs-paths-extra=/usr/sbin:/usr/bin

Re: util-linux: backport fix for su(1)

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 185 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148095039

Comment:
I meant to the PR you made updating it

Re: util-linux: backport fix for su(1)

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 192 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148095039

Comment:
I meant add it to the PR you made updating it

Re: util-linux: backport fix for su(1)

[tanpsi]

[-- Attachment #1: Type: text/plain, Size: 296 bytes --]

New comment by tanpsi on void-packages repository

https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148115215

Comment:
Oops, that's already included in 2.40. I thought that update would take some time to get through, so you are suggesting backporting it to the 2.39 version.

Re: util-linux: backport fix for su(1)

[tanpsi]

[-- Attachment #1: Type: text/plain, Size: 296 bytes --]

New comment by tanpsi on void-packages repository

https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148115215

Comment:
Oops! that's already included in 2.40. I thought that update would take some time to get through, so you are suggesting backporting it to the 2.39 version.

Re: util-linux: backport fix for su(1)

[tanpsi]

[-- Attachment #1: Type: text/plain, Size: 297 bytes --]

New comment by tanpsi on void-packages repository

https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148115215

Comment:
Oops! this is already included in 2.40. I thought that update would take some time to get through, so you are suggesting backporting it to the 2.39 version.

Re: [PR PATCH] [Closed]: util-linux: backport fix for su(1)

[tanpsi]

[-- Attachment #1: Type: text/plain, Size: 1139 bytes --]

There's a closed pull request on the void-packages repository

util-linux: backport fix for su(1)
https://github.com/void-linux/void-packages/pull/50686

Description:
<!-- Uncomment relevant sections and delete options which are not applicable -->

#### Testing the changes
- I tested the changes in this PR: **YES**

<!--
#### New package
- This new package conforms to the [package requirements](https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#package-requirements): **YES**|**NO**
-->

<!-- Note: If the build is likely to take more than 2 hours, please add ci skip tag as described in
https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#continuous-integration
and test at least one native build and, if supported, at least one cross build.
Ignore this section if this PR is not skipping CI.
-->
#### Local build testing
- I built this PR locally for my native architecture, (x86_64-glibc)
<br>

This is a backport for the [upstream fix](https://github.com/util-linux/util-linux/commit/4b2e6f5071a4c5beebbd9668d24dc05defc096d7). It was suggested by @classabbyamp at #50538