diff --git a/src/bin/system/e_system_main.c b/src/bin/system/e_system_main.c index 3165b0a3f..d33c11109 100644 --- a/src/bin/system/e_system_main.c +++ b/src/bin/system/e_system_main.c @@ -94,7 +94,7 @@ static void setuid_setup(void) { struct passwd *pwent; - static char buf[4096]; + static char buf[PATH_MAX]; uid = getuid(); gid = getgid(); @@ -126,6 +126,16 @@ setuid_setup(void) fprintf(stderr, "Root homedir too long\n"); exit(1); } + if (pwent->pw_dir[0] != '/') + { + fprintf(stderr, "Root homedir %s is not a full path\n", pwent->pw_dir); + exit(1); + } + if (!realpath(pwent->pw_dir, buf)) + { + fprintf(stderr, "Root homedir %s does not resolve\n", pwent->pw_dir); + exit(1); + } snprintf(buf, sizeof(buf), "HOME=%s", pwent->pw_dir); if (putenv(buf) == -1) {