shadow-maint / shadow

Upstream shadow tree
Other
290 stars 228 forks source link

`copy_entry()` uses uninitialized data #973

Closed ensc closed 4 months ago

ensc commented 4 months ago

https://github.com/shadow-maint/shadow/blob/2b67dc77651874999258c9ca4ebd57ed03cabe37/lib/copydir.c#L426-L434

assumes that fstatat() does not clobber sb on errors. But there is no such guarantee so that the following code might access uninitialized/random data within sb.

The fstatat() call should be done with a temporary buffer.