From 16a32c53f6e9ad1f3284d4596edfa33e9efb740e Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Thu, 9 Oct 2014 05:42:09 -0700 Subject: [PATCH] If fork fails in System(), don't fallthrough to exec() In the unlikely event of a failure in creating processes, signal masks will fall from the panels above you. Secure your mask before telling your child what to do, since it won't exist, and you will instead cause the server itself to be replaced by a shell running the target program. Found by Coverity #53397: Missing break in switch Execution falls through to the next case statement or default; this might indicate a common typo. In System: Missing break statement between cases in switch statement (CWE-484) Signed-off-by: Alan Coopersmith Reviewed-by: Matthieu Herrb Signed-off-by: Keith Packard --- os/utils.c | 1 + 1 file changed, 1 insertion(+) diff --git a/os/utils.c b/os/utils.c index 80415c4b0..75769f17c 100644 --- a/os/utils.c +++ b/os/utils.c @@ -1373,6 +1373,7 @@ System(const char *command) switch (pid = fork()) { case -1: /* error */ p = -1; + break; case 0: /* child */ if (setgid(getgid()) == -1) _exit(127);