VesperOS/shadow
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

src/vipw.c: Use string literals to initialize 'Prog'

Browse Source 
This avoids using argv[0], which is controlled by the user,
and might inject arbitrary text in stderr and the logs.

Link: <https://github.com/shadow-maint/shadow/issues/959>
Link: <https://github.com/shadow-maint/shadow/pull/960>
Cc: "Skyler Ferrante (RIT Student)" <sjf5462@rit.edu>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Karel Zak <kzak@redhat.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Christian Brauner <christian@brauner.io>
Cherry-picked-from: 89c4da43cb ("src/vipw.c: Use string literals to initialize 'Prog'")
Link: <https://github.com/shadow-maint/shadow/pull/962>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
This commit is contained in:
Alejandro Colomar
2024-03-07 23:38:48 +01:00
parent 470d6be230
commit 39192107a6
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/vipw.c
View File

@@ -52,7 +52,7 @@
/*
* Global variables
*/
const char *Prog;
static const char *Prog;
static const char *filename, *fileeditname;
static bool filelocked = false;
@@ -472,7 +472,9 @@ int main (int argc, char **argv)
bool editshadow = false;
bool do_vigr;
Prog = Basename (argv[0]);
do_vigr = (strcmp(Basename(argv[0]), "vigr") == 0);
Prog = do_vigr ? "vigr" : "vipw";
log_set_progname(Prog);
log_set_logfd(stderr);
@@ -482,9 +484,7 @@ int main (int argc, char **argv)
process_root_flag ("-R", argc, argv);
do_vigr = (strcmp(Prog, "vigr") == 0);
OPENLOG(do_vigr ? "vigr" : "vipw");
OPENLOG(Prog);
{
/*