search

google / google-authenticator-libpam

Apache License 2.0
1.77k stars 281 forks source link

The 2nd argument 'home' of function 'strcpy()' is tained #132

Closed QiAnXinCodeSafe closed 5 years ago

QiAnXinCodeSafe commented 5 years ago

in line 843: https://github.com/google/google-authenticator-libpam/blob/842142d52328baa6076826428fe040db98aab82a/src/google-authenticator.c#L843

The 2nd argument 'home' of function 'strcpy()' is assigned in line 833: const char *home = getenv("HOME");

ThomasHabets commented 5 years ago

So what? $HOME comes from the user, yes. So does -s.