shadow/patches/shadow-4.1.5-userdel-avoid-bad-mem-access.patch

Index: src/userdel.c
===================================================================
--- src/userdel.c	(revision 3713)
+++ src/userdel.c	(working copy)
@@ -329,26 +329,33 @@
	}

	if (NULL == pwd) {
+		char gr_name[GROUP_NAME_MAX_LENGTH + 1];
+
+		/* make a copy of the group name before we delete it.
+		 * we can't use ->gr_name after the group is deleted
+		 * for logging purposes */
+		snprintf(gr_name, GROUP_NAME_MAX_LENGTH, "%s", grp->gr_name);
+
		/*
		 * We can remove this group, it is not the primary
		 * group of any remaining user.
		 */
-		if (gr_remove (grp->gr_name) == 0) {
+		if (gr_remove (gr_name) == 0) {
			fprintf (stderr,
			         _("%s: cannot remove entry '%s' from %s\n"),
-			         Prog, grp->gr_name, gr_dbname ());
+			         Prog, gr_name, gr_dbname ());
			fail_exit (E_GRP_UPDATE);
		}

 #ifdef WITH_AUDIT
		audit_logger (AUDIT_DEL_GROUP, Prog,
		              "deleting group",
-		              grp->gr_name, AUDIT_NO_ID,
+		              gr_name, AUDIT_NO_ID,
		              SHADOW_AUDIT_SUCCESS);
 #endif				/* WITH_AUDIT */
		SYSLOG ((LOG_INFO,
		         "removed group '%s' owned by '%s'\n",
-		         grp->gr_name, user_name));
+		         gr_name, user_name));

 #ifdef	SHADOWGRP
		if (sgr_locate (user_name) != NULL) {
@@ -361,12 +368,12 @@
 #ifdef WITH_AUDIT
			audit_logger (AUDIT_DEL_GROUP, Prog,
			              "deleting shadow group",
-			              grp->gr_name, AUDIT_NO_ID,
+			              gr_name, AUDIT_NO_ID,
			              SHADOW_AUDIT_SUCCESS);
 #endif				/* WITH_AUDIT */
			SYSLOG ((LOG_INFO,
			         "removed shadow group '%s' owned by '%s'\n",
-			         grp->gr_name, user_name));
+			         gr_name, user_name));

		}
 #endif				/* SHADOWGRP */
1	niro	1667	Index: src/userdel.c
2			===================================================================
3			--- src/userdel.c (revision 3713)
4			+++ src/userdel.c (working copy)
5			@@ -329,26 +329,33 @@
6			}
7
8			if (NULL == pwd) {
9			+ char gr_name[GROUP_NAME_MAX_LENGTH + 1];
10			+
11			+ /* make a copy of the group name before we delete it.
12			+ * we can't use ->gr_name after the group is deleted
13			+ * for logging purposes */
14			+ snprintf(gr_name, GROUP_NAME_MAX_LENGTH, "%s", grp->gr_name);
15			+
16			/*
17			* We can remove this group, it is not the primary
18			* group of any remaining user.
19			*/
20			- if (gr_remove (grp->gr_name) == 0) {
21			+ if (gr_remove (gr_name) == 0) {
22			fprintf (stderr,
23			_("%s: cannot remove entry '%s' from %s\n"),
24			- Prog, grp->gr_name, gr_dbname ());
25			+ Prog, gr_name, gr_dbname ());
26			fail_exit (E_GRP_UPDATE);
27			}
28
29			#ifdef WITH_AUDIT
30			audit_logger (AUDIT_DEL_GROUP, Prog,
31			"deleting group",
32			- grp->gr_name, AUDIT_NO_ID,
33			+ gr_name, AUDIT_NO_ID,
34			SHADOW_AUDIT_SUCCESS);
35			#endif /* WITH_AUDIT */
36			SYSLOG ((LOG_INFO,
37			"removed group '%s' owned by '%s'\n",
38			- grp->gr_name, user_name));
39			+ gr_name, user_name));
40
41			#ifdef SHADOWGRP
42			if (sgr_locate (user_name) != NULL) {
43			@@ -361,12 +368,12 @@
44			#ifdef WITH_AUDIT
45			audit_logger (AUDIT_DEL_GROUP, Prog,
46			"deleting shadow group",
47			- grp->gr_name, AUDIT_NO_ID,
48			+ gr_name, AUDIT_NO_ID,
49			SHADOW_AUDIT_SUCCESS);
50			#endif /* WITH_AUDIT */
51			SYSLOG ((LOG_INFO,
52			"removed shadow group '%s' owned by '%s'\n",
53			- grp->gr_name, user_name));
54			+ gr_name, user_name));
55
56			}
57			#endif /* SHADOWGRP */