Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Content-Length: 1241
Hello, I was looking at ksu and noticed this code from src/clients/ksu/main.c in the 1.16 distribution assumes that argc cannot be zero, but at least on Linux that is not true - if you pass NULL for argv to execve(), argc will be zero.
target_user = xstrdup(argv[1]);
pargc = argc -1;
if ((pargv =(char **) calloc(pargc +1,sizeof(char *)))==NULL){
com_err(prog_name, errno, _("while allocating memory"));
exit(1);
}
pargv[pargc] = NULL;
pargv[0] = argv[0];
for(i =1; i< pargc; i ++){
pargv[i] = argv[i + 1];
}
}
I think this will just crash, because of the strdup(NULL), but if that succeeds on any platform this code will write NULL to pargv[-1], causing heap corruption.
(on linux execve("/usr/bin/ksu", NULL, NULL) will make argc zero, if you want to test)
Thanks, Tavis.