VesperOS/shadow
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

src/vipw.c: Use string literals to initialize 'Prog'

Browse Source 
This avoids using argv[0], which is controlled by the user,
and might inject arbitrary text in stderr and the logs.

Link: <https://github.com/shadow-maint/shadow/issues/959>
Link: <https://github.com/shadow-maint/shadow/pull/960>
Cc: "Skyler Ferrante (RIT Student)" <sjf5462@rit.edu>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Karel Zak <kzak@redhat.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Cc: Christian Brauner <christian@brauner.io>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
This commit is contained in:
Alejandro Colomar
2024-03-08 10:24:15 -06:00
committed by Serge Hallyn
parent 0ab893a734
commit 89c4da43cb
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/vipw.c
+5 -5
View File
@@ -55,7 +55,7 @@
/* /*
* Global variables * Global variables
*/ */
const char *Prog; static const char *Prog;
static const char *filename, *fileeditname; static const char *filename, *fileeditname;
static bool filelocked = false; static bool filelocked = false;
@@ -471,7 +471,9 @@ int main (int argc, char **argv)
bool editshadow = false; bool editshadow = false;
bool do_vigr; bool do_vigr;
Prog = Basename (argv[0]); do_vigr = (strcmp(Basename(argv[0]), "vigr") == 0);
Prog = do_vigr ? "vigr" : "vipw";
log_set_progname(Prog); log_set_progname(Prog);
log_set_logfd(stderr); log_set_logfd(stderr);
@@ -481,9 +483,7 @@ int main (int argc, char **argv)
process_root_flag ("-R", argc, argv); process_root_flag ("-R", argc, argv);
do_vigr = (strcmp(Prog, "vigr") == 0); OPENLOG(Prog);
OPENLOG(do_vigr ? "vigr" : "vipw");
{ {
/* /*