Fix use after free in execute_with_shell.

freebsd / atf

Libraries to write tests in C, C++ and shell

Other

127 stars 44 forks source link

Fix use after free in execute_with_shell. #57

Closed Apteryks closed 5 months ago

Apteryks commented 5 months ago

The temporary string returned by atf::env::get would be used outside its statement, which is invalid and cause undefined behavior. Copy it to a local variable to avoid the issue.

Fixes: https://github.com/freebsd/atf/issues/26 Fixes: https://github.com/freebsd/kyua/issues/223

Reported-by: Ruslan Bukin br@bsdpad.com

kevans91 commented 5 months ago

I note that we have this fixes (the same way) in freebsd-src/contrib and a couple other changes; we should probably resync some of those back to this repo. Thanks!