[Pkg-shadow-devel] [PATCH] Fix crash in userdel on group deletion

[Dave Reisner]

Hi all,

userdel crashes on i686 (and probably elsewhere as well) when it deletes
an empty group because it tries to log the name of the group it just
deleted. I've attached a patch which addresses this by simply making a
stack allocated copy of the group name prior to deletion.

Regards,
Dave
-------------- next part --------------
--- ./src/userdel.c.orig	2012-02-22 20:34:21.152751020 -0500
+++ ./src/userdel.c	2012-02-22 20:36:17.032299499 -0500
@@ -286,6 +286,7 @@
 {
 	const struct group *grp;
 	const struct passwd *pwd = NULL;
+	char groupname[GROUP_NAME_MAX_LENGTH + 1] = {0};
 
 	grp = gr_locate (user_name);
 	if (NULL == grp) {
@@ -328,6 +329,9 @@
 		endpwent ();
 	}
 
+	/* make a copy of the group name before we delete it */
+	snprintf(groupname, GROUP_NAME_MAX_LENGTH, "%s", grp->gr_name);
+
 	if (NULL == pwd) {
 		/*
 		 * We can remove this group, it is not the primary
@@ -343,12 +347,12 @@
 #ifdef WITH_AUDIT
 		audit_logger (AUDIT_DEL_GROUP, Prog,
 		              "deleting group",
-		              grp->gr_name, AUDIT_NO_ID,
+		              groupname, AUDIT_NO_ID,
 		              SHADOW_AUDIT_SUCCESS);
 #endif				/* WITH_AUDIT */
 		SYSLOG ((LOG_INFO,
 		         "removed group '%s' owned by '%s'\n",
-		         grp->gr_name, user_name));
+		         groupname, user_name));
 
 #ifdef	SHADOWGRP
 		if (sgr_locate (user_name) != NULL) {
@@ -361,12 +365,12 @@
 #ifdef WITH_AUDIT
 			audit_logger (AUDIT_DEL_GROUP, Prog,
 			              "deleting shadow group",
-			              grp->gr_name, AUDIT_NO_ID,
+			              groupname, AUDIT_NO_ID,
 			              SHADOW_AUDIT_SUCCESS);
 #endif				/* WITH_AUDIT */
 			SYSLOG ((LOG_INFO,
 			         "removed shadow group '%s' owned by '%s'\n",
-			         grp->gr_name, user_name));
+			         groupname, user_name));
 
 		}
 #endif				/* SHADOWGRP */