[Pkg-shadow-devel] Bug#402002: passwd: pwconv aborts with double free on GNU/Hurd

[Michael Banck]

Package: passwd
Version: 1:4.0.18.1-5
Severity: important

Hi,

the patch I sent in #372155 had a bug, it freed f unconditionally at the
end of the function, even when the condition leading to its allocation
wasn't met.  pwconv then failed with a glibc error on the Hurd:

goober:~# pwconv
*** glibc detected *** double free or corruption (out): 0x080550c8 ***
Aborted

I've attached an updated version of 403_fix_PATH-MAX_hurd which makes
pwconv work fine again on the Hurd.  Sorry about that.


Michael
-------------- next part --------------
Goal: Fix FTBFS on Hurd because PATH-MAX is undefined

Fix: #372155

Author: Michael Banck  <mbanck at debian.org>

Status wrt upstream: should be forwarded

Index: shadow-4.0.18.1/lib/commonio.c
===================================================================
--- shadow-4.0.18.1/lib/commonio.c.orig	2006-12-07 06:57:01.000000000 +0000
+++ shadow-4.0.18.1/lib/commonio.c	2006-12-07 06:57:40.000000000 +0000
@@ -46,17 +47,31 @@
 int lrename (const char *old, const char *new)
 {
 
+#ifdef PATH_MAX
 	char resolved_path[PATH_MAX];
+#endif
+	char *r;
 	int res;
 
 #if defined(S_ISLNK)
 	struct stat sb = { 0 };
 	if (lstat (new, &sb) == 0 && S_ISLNK (sb.st_mode)) {
-		if (realpath (new, resolved_path) == NULL) {
+#ifndef PATH_MAX
+		r = realpath (new, NULL);
+#else
+		r = realpath (new, resolved_path);
+#endif
+		if (r == NULL) {
+#ifndef PATH_MAX
+			free (r);
+#endif
 			perror ("realpath in lrename()");
 		} else {
-			new = resolved_path;
+			new = r;
 		}
+#ifndef PATH_MAX
+	free (r);
+#endif
 	}
 #endif
 	res = rename (old, new);