From e16c96b1692eed1cbc9ce00fc15a28167aafa753 Mon Sep 17 00:00:00 2001 From: Alejandro Colomar Date: Sun, 1 Mar 2026 14:23:23 +0100 Subject: [PATCH] src/useradd.c: create_home(): Fix benign off-by-one bug 'path' will only copy contents from 'bhome', which itself is a dup of 'prefix_user_home'. Thus it only needs to be able to hold the contents of that string (thus, strlen(3) + 1 for the NUL). We don't add any characters that were not present in the original string (but we do collapse adjacent slashes), and thus the 'path' string may be shorter or as long as 'bhome', but certainly not longer. This seems to have been an off-by-one calculation, as this code has never needed space for an extra byte, AFAICS. Fixes: b3b6d9d7 (2018-05-15; "Create parent dirs for useradd -m") Link: Link: Cc: Michael Vetter Cc: Thorsten Behrens Cc: Thorsten Kukuk Cc: Serge Hallyn Cc: Eric Seifert Cc: Iker Pedrosa Signed-off-by: Alejandro Colomar --- src/useradd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/useradd.c b/src/useradd.c index 25b7f4f3c9..f8bc930a20 100644 --- a/src/useradd.c +++ b/src/useradd.c @@ -2183,7 +2183,7 @@ want_btrfs_subvolume(const char *path) */ static void create_home(const struct option_flags *flags) { - char path[strlen(prefix_user_home) + 2]; + char path[strlen(prefix_user_home) + 1]; char *bhome, *cp; mode_t mode; bool process_selinux;