From: =?UTF-8?q?Miloslav=20Trma=C4=8D?= Date: Tue, 26 Aug 2014 17:59:47 +0200 Subject: [PATCH] 0.113: Refuse duplicate --user arguments to pkexec This usage is clearly erroneous, so we should tell the users they are making a mistake. Besides, this allows an attacker to cause a high number of heap allocations with attacker-controlled sizes ( http://googleprojectzero.blogspot.cz/2014/08/the-poisoned-nul-byte-2014-edition.html ), making some exploits easier. (To be clear, this is not a pkexec vulnerability, and we will not refuse attacker-affected malloc() usage as a matter of policy; but this commit is both user-friendly and adding some hardening.) Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83093 Origin: upstream, 0.113, commit:6c992bc8aefa195a41eaa41c07f46f17de18e25c Imported from policykit-1_0.105-25.debian.tar.xz Signed-off-by: Michael Olbrich --- src/programs/pkexec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c index 5e99044311ac..abc660dfddc6 100644 --- a/src/programs/pkexec.c +++ b/src/programs/pkexec.c @@ -533,6 +533,11 @@ main (int argc, char *argv[]) goto out; } + if (opt_user != NULL) + { + g_printerr ("--user specified twice\n"); + goto out; + } opt_user = g_strdup (argv[n]); } else if (strcmp (argv[n], "--disable-internal-agent") == 0)