isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix a dereference (read) of a freed pointer. Reported by Patrick Williams.

Browse Source
This commit is contained in:
Todd C. Miller
2008-09-11 11:06:37 +00:00
parent a5245c2358
commit d0a44e437c
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
match.c
View File

@@ -1,5 +1,6 @@
/* /*
* Copyright (c) 1996, 1998-2005 Todd C. Miller <Todd.Miller@courtesan.com> * Copyright (c) 1996, 1998-2005, 2008
* Todd C. Miller <Todd.Miller@courtesan.com>
* *
* Permission to use, copy, modify, and distribute this software for any * Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above * purpose with or without fee is hereby granted, provided that the above
@@ -369,9 +370,10 @@ command_matches(sudoers_cmnd, sudoers_args)
{ {
struct stat sudoers_stat; struct stat sudoers_stat;
struct dirent *dent; struct dirent *dent;
char **ap, *base, buf[PATH_MAX]; char *cp, *base, buf[PATH_MAX];
glob_t gl; glob_t gl;
DIR *dirp; DIR *dirp;
int i;
/* Check for pseudo-commands */ /* Check for pseudo-commands */
if (strchr(user_cmnd, '/') == NULL) { if (strchr(user_cmnd, '/') == NULL) {
@@ -413,25 +415,26 @@ command_matches(sudoers_cmnd, sudoers_args)
return(FALSE); return(FALSE);
} }
/* For each glob match, compare basename, st_dev and st_ino. */ /* For each glob match, compare basename, st_dev and st_ino. */
for (ap = gl.gl_pathv; *ap != NULL; ap++) { i = 0;
while ((cp = gl.gl_pathv[i++])) {
/* only stat if basenames are the same */ /* only stat if basenames are the same */
if ((base = strrchr(*ap, '/')) != NULL) if ((base = strrchr(cp, '/')) != NULL)
base++; base++;
else else
base = *ap; base = cp;
if (strcmp(user_base, base) != 0 || if (strcmp(user_base, base) != 0 ||
stat(*ap, &sudoers_stat) == -1) stat(cp, &sudoers_stat) == -1)
continue; continue;
if (user_stat == NULL || if (user_stat == NULL ||
(user_stat->st_dev == sudoers_stat.st_dev && (user_stat->st_dev == sudoers_stat.st_dev &&
user_stat->st_ino == sudoers_stat.st_ino)) { user_stat->st_ino == sudoers_stat.st_ino)) {
efree(safe_cmnd); efree(safe_cmnd);
safe_cmnd = estrdup(*ap); safe_cmnd = estrdup(cp);
break; break;
} }
} }
globfree(&gl); globfree(&gl);
if (*ap == NULL) if (cp == NULL)
return(FALSE); return(FALSE);
if (!sudoers_args || if (!sudoers_args ||