mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2026-04-29 06:46:38 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: fix command injection via system() in pw-container

Browse source 
Input Validation: High

system() passes its argument to /bin/sh -c, which interprets shell
metacharacters (;, |, &&, $(), etc.). If pw-container is invoked by
another program with untrusted input, this allows arbitrary command
execution. Replace with fork()+execvp() which executes the command
directly without shell interpretation, and passes all remaining
arguments to the child process.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Wim Taymans 2026-04-27 16:12:26 +02:00
parent edb3c27aa4
commit 15c32c66f0
1 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/tools/pw-container.c
View file

@ -11,6 +11,7 @@
#include <locale.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <spa/utils/result.h>
#include <spa/utils/string.h>
@ -283,7 +284,17 @@ int main(int argc, char *argv[])
}
if (optind < argc) {
system(argv[optind++]);
pid_t pid = fork();
if (pid < 0) {
fprintf(stderr, "can't fork: %m\n");
return -1;
}
if (pid == 0) {
execvp(argv[optind], &argv[optind]);
fprintf(stderr, "can't exec %s: %m\n", argv[optind]);
_exit(127);
}
waitpid(pid, NULL, 0);
} else {
fprintf(stdout, "new socket: %s\n", temp);
pw_main_loop_run(data.loop);