* [PR PATCH] util-linux: backport fix for su(1)
@ 2024-06-04 17:10 tanpsi
2024-06-04 17:53 ` classabbyamp
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: tanpsi @ 2024-06-04 17:10 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 1294 bytes --]
There is a new pull request by tanpsi against master on the void-packages repository
https://github.com/tanpsi/void-packages util-linux-su
https://github.com/void-linux/void-packages/pull/50686
util-linux: backport fix for su(1)
<!-- Uncomment relevant sections and delete options which are not applicable -->
#### Testing the changes
- I tested the changes in this PR: **YES**
<!--
#### New package
- This new package conforms to the [package requirements](https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#package-requirements): **YES**|**NO**
-->
<!-- Note: If the build is likely to take more than 2 hours, please add ci skip tag as described in
https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#continuous-integration
and test at least one native build and, if supported, at least one cross build.
Ignore this section if this PR is not skipping CI.
-->
#### Local build testing
- I built this PR locally for my native architecture, (x86_64-glibc)
<br>
This is a backport for the [upstream fix](https://github.com/util-linux/util-linux/commit/4b2e6f5071a4c5beebbd9668d24dc05defc096d7). It was suggested by @classabbyamp at #50538
A patch file from https://github.com/void-linux/void-packages/pull/50686.patch is attached
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-util-linux-su-50686.patch --]
[-- Type: text/x-diff, Size: 2836 bytes --]
From 53fc725e4e7841dc2540d7a6109792f314749973 Mon Sep 17 00:00:00 2001
From: Tanish Yadav <devtany@gmail.com>
Date: Tue, 4 Jun 2024 22:19:36 +0530
Subject: [PATCH] util-linux: su: fix use after free in run_shell
---
.../su-fix-use-after-free-in-run_shell.patch | 49 +++++++++++++++++++
srcpkgs/util-linux/template | 2 +-
2 files changed, 50 insertions(+), 1 deletion(-)
create mode 100644 srcpkgs/util-linux/patches/su-fix-use-after-free-in-run_shell.patch
diff --git a/srcpkgs/util-linux/patches/su-fix-use-after-free-in-run_shell.patch b/srcpkgs/util-linux/patches/su-fix-use-after-free-in-run_shell.patch
new file mode 100644
index 00000000000000..daf0f4a88b3883
--- /dev/null
+++ b/srcpkgs/util-linux/patches/su-fix-use-after-free-in-run_shell.patch
@@ -0,0 +1,49 @@
+From 4b2e6f5071a4c5beebbd9668d24dc05defc096d7 Mon Sep 17 00:00:00 2001
+From: Tanish Yadav <devtany@gmail.com>
+Date: Tue, 5 Mar 2024 00:51:41 +0530
+Subject: [PATCH] su: fix use after free in run_shell
+
+Do not free tmp for non login branch as basename may return a pointer to
+some part of it.
+
+[kzak@redhat.com: - improve coding style of the function]
+
+Signed-off-by: Tanish Yadav <devtany@gmail.com>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ login-utils/su-common.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/login-utils/su-common.c b/login-utils/su-common.c
+index 242b6ce4e..9bc023196 100644
+--- a/login-utils/su-common.c
++++ b/login-utils/su-common.c
+@@ -835,13 +835,14 @@ static void run_shell(
+ size_t n_args = 1 + su->fast_startup + 2 * ! !command + n_additional_args + 1;
+ const char **args = xcalloc(n_args, sizeof *args);
+ size_t argno = 1;
++ char *tmp;
+
+ DBG(MISC, ul_debug("starting shell [shell=%s, command=\"%s\"%s%s]",
+ shell, command,
+ su->simulate_login ? " login" : "",
+ su->fast_startup ? " fast-start" : ""));
++ tmp = xstrdup(shell);
+
+- char* tmp = xstrdup(shell);
+ if (su->simulate_login) {
+ char *arg0;
+ char *shell_basename;
+@@ -851,10 +852,8 @@ static void run_shell(
+ arg0[0] = '-';
+ strcpy(arg0 + 1, shell_basename);
+ args[0] = arg0;
+- } else {
+- args[0] = basename(tmp);
+- }
+- free(tmp);
++ } else
++ args[0] = basename(tmp);
+
+ if (su->fast_startup)
+ args[argno++] = "-f";
diff --git a/srcpkgs/util-linux/template b/srcpkgs/util-linux/template
index 64f262c25a4a59..cbd705736f93aa 100644
--- a/srcpkgs/util-linux/template
+++ b/srcpkgs/util-linux/template
@@ -2,7 +2,7 @@
# Keep this package sync with util-linux-common
pkgname=util-linux
version=2.39.3
-revision=2
+revision=3
build_style=gnu-configure
configure_args="--exec-prefix=\${prefix} --enable-libuuid --disable-makeinstall-chown
--enable-libblkid --enable-fsck --disable-rpath --enable-fs-paths-extra=/usr/sbin:/usr/bin
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: util-linux: backport fix for su(1)
2024-06-04 17:10 [PR PATCH] util-linux: backport fix for su(1) tanpsi
@ 2024-06-04 17:53 ` classabbyamp
2024-06-04 18:01 ` classabbyamp
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: classabbyamp @ 2024-06-04 17:53 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 185 bytes --]
New comment by classabbyamp on void-packages repository
https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148095039
Comment:
I meant to the PR you made updating it
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: util-linux: backport fix for su(1)
2024-06-04 17:10 [PR PATCH] util-linux: backport fix for su(1) tanpsi
2024-06-04 17:53 ` classabbyamp
@ 2024-06-04 18:01 ` classabbyamp
2024-06-04 18:06 ` tanpsi
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: classabbyamp @ 2024-06-04 18:01 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 192 bytes --]
New comment by classabbyamp on void-packages repository
https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148095039
Comment:
I meant add it to the PR you made updating it
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: util-linux: backport fix for su(1)
2024-06-04 17:10 [PR PATCH] util-linux: backport fix for su(1) tanpsi
2024-06-04 17:53 ` classabbyamp
2024-06-04 18:01 ` classabbyamp
@ 2024-06-04 18:06 ` tanpsi
2024-06-04 18:08 ` tanpsi
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: tanpsi @ 2024-06-04 18:06 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 296 bytes --]
New comment by tanpsi on void-packages repository
https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148115215
Comment:
Oops, that's already included in 2.40. I thought that update would take some time to get through, so you are suggesting backporting it to the 2.39 version.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: util-linux: backport fix for su(1)
2024-06-04 17:10 [PR PATCH] util-linux: backport fix for su(1) tanpsi
` (2 preceding siblings ...)
2024-06-04 18:06 ` tanpsi
@ 2024-06-04 18:08 ` tanpsi
2024-06-04 18:10 ` tanpsi
2024-06-05 4:58 ` [PR PATCH] [Closed]: " tanpsi
5 siblings, 0 replies; 7+ messages in thread
From: tanpsi @ 2024-06-04 18:08 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 296 bytes --]
New comment by tanpsi on void-packages repository
https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148115215
Comment:
Oops! that's already included in 2.40. I thought that update would take some time to get through, so you are suggesting backporting it to the 2.39 version.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: util-linux: backport fix for su(1)
2024-06-04 17:10 [PR PATCH] util-linux: backport fix for su(1) tanpsi
` (3 preceding siblings ...)
2024-06-04 18:08 ` tanpsi
@ 2024-06-04 18:10 ` tanpsi
2024-06-05 4:58 ` [PR PATCH] [Closed]: " tanpsi
5 siblings, 0 replies; 7+ messages in thread
From: tanpsi @ 2024-06-04 18:10 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 297 bytes --]
New comment by tanpsi on void-packages repository
https://github.com/void-linux/void-packages/pull/50686#issuecomment-2148115215
Comment:
Oops! this is already included in 2.40. I thought that update would take some time to get through, so you are suggesting backporting it to the 2.39 version.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PR PATCH] [Closed]: util-linux: backport fix for su(1)
2024-06-04 17:10 [PR PATCH] util-linux: backport fix for su(1) tanpsi
` (4 preceding siblings ...)
2024-06-04 18:10 ` tanpsi
@ 2024-06-05 4:58 ` tanpsi
5 siblings, 0 replies; 7+ messages in thread
From: tanpsi @ 2024-06-05 4:58 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 1139 bytes --]
There's a closed pull request on the void-packages repository
util-linux: backport fix for su(1)
https://github.com/void-linux/void-packages/pull/50686
Description:
<!-- Uncomment relevant sections and delete options which are not applicable -->
#### Testing the changes
- I tested the changes in this PR: **YES**
<!--
#### New package
- This new package conforms to the [package requirements](https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#package-requirements): **YES**|**NO**
-->
<!-- Note: If the build is likely to take more than 2 hours, please add ci skip tag as described in
https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#continuous-integration
and test at least one native build and, if supported, at least one cross build.
Ignore this section if this PR is not skipping CI.
-->
#### Local build testing
- I built this PR locally for my native architecture, (x86_64-glibc)
<br>
This is a backport for the [upstream fix](https://github.com/util-linux/util-linux/commit/4b2e6f5071a4c5beebbd9668d24dc05defc096d7). It was suggested by @classabbyamp at #50538
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2024-06-05 4:58 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-06-04 17:10 [PR PATCH] util-linux: backport fix for su(1) tanpsi
2024-06-04 17:53 ` classabbyamp
2024-06-04 18:01 ` classabbyamp
2024-06-04 18:06 ` tanpsi
2024-06-04 18:08 ` tanpsi
2024-06-04 18:10 ` tanpsi
2024-06-05 4:58 ` [PR PATCH] [Closed]: " tanpsi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).