* src/chroot.c (main): Copy pwd->pw_name as it can be overwritten.
* NEWS: Mention the fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-C8RRA4R8.
---
NEWS | 6 +++---
src/chroot.c | 4 +++-
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/NEWS b/NEWS
index 786d11a4b..73f0ccb2e 100644
--- a/NEWS
+++ b/NEWS
@@ -15,9 +15,9 @@ GNU coreutils NEWS -*-
outline -*-
when only a partial context is specified.
[bug introduced with the chcon program in coreutils-6.9.90]
- 'chroot --userspec=USER' now uses the primary group of USER as looked up
- inside the chroot. Previously the group looked up outside the chroot
- was used, even when the look-up inside the chroot succeeded.
+ 'chroot --userspec=USER' now uses the primary group of USER from inside the
+ chroot. Also this no longer sets supplemental groups of an unrelated user,
+ or reads freed memory, when the USER ID is only known outside the chroot.
[bug introduced in coreutils-8.23]
'cksum' now detects GNU and BSD reversed formats for each checksum file.
diff --git a/src/chroot.c b/src/chroot.c
index cad94264e..92c93b794 100644
--- a/src/chroot.c
+++ b/src/chroot.c
@@ -315,7 +315,9 @@ main (int argc, char **argv)
gid = pwd->pw_gid;
gid_inferred = true;
}
- username = pwd->pw_name;
+ /* Copy, as the look-up inside the chroot reuses PWD's
+ storage, even when it fails. */
+ username = xstrdup (pwd->pw_name);
}
}
--
2.56.0
