Make a copy of the shell field in the passwd struct for NewArgv to avoid

a use after free situation after sudo_endpwent() is called.

diff --git a/sudo.c b/sudo.c
index a41310d2c41adfdbac55f6469c924421643ef074..a68daf577180d8721654865da1b5f2cf93ca7f84 100644 (file)
--- a/sudo.c
+++ b/sudo.c
@@ -584,7 +584,7 @@ init_vars(sudo_mode, envp)
        log_error(0, "uid %s does not exist in the passwd file!", pw_name);
     }
     if (user_shell == NULL || *user_shell == '\0')
-       user_shell = sudo_user.pw->pw_shell;
+       user_shell = estrdup(sudo_user.pw->pw_shell);
 
     /* It is now safe to use log_error() and set_perms() */
 
@@ -633,7 +633,7 @@ init_vars(sudo_mode, envp)
        if (ISSET(sudo_mode, MODE_EDIT))
            NewArgv[0] = "sudoedit";
        else if (ISSET(sudo_mode, MODE_LOGIN_SHELL))
-           NewArgv[0] = runas_pw->pw_shell;
+           NewArgv[0] = estrdup(runas_pw->pw_shell);
        else if (user_shell && *user_shell)
            NewArgv[0] = user_shell;
        else