Bug on su using -c option

[Mathieu Sivade]

Hello,


I just encountered a bug on my CentOS5 using su -c.
I have a small piece of C code to spawn processes, and I wanted theses
processes to run under a certain user with specific rights to the
filesystem.
To execute this, I created a user named 'ejabberd', my daemon executable
file was 'dispatch_daemon'.
As you can see in dispatch_daemon.c, I realloc my buffer when it needs
to.

Here is the error I get when running the daemon through su -c
'./dispatch_daemon 5284' ejabberd :

        [tcsetpgrp failed in terminal_inferior: Inappropriate ioctl for
        device]
        *** glibc detected
        *** /usr/local/ejabberd/bin/IperExternModule/dispatch_daemon:
        realloc(): invalid next size: 0x09d79008 ***
        [tcsetpgrp failed in terminal_inferior: Inappropriate ioctl for
        device]
        [tcsetpgrp failed in terminal_inferior: Inappropriate ioctl for
        device]
        ======= Backtrace: =========
        /lib/libc.so.6[0x43f63920]
        /lib/libc.so.6(realloc+0xfe)[0x43f6580e]
        /lib/libc.so.6[0x43f65be1]
        /lib/libc.so.6(realloc+0x3c)[0x43f6574c]
        /usr/local/ejabberd/bin/IperExternModule/dispatch_daemon[0x804891e]
        /lib/libc.so.6(__libc_start_main+0xdc)[0x43f11dec]
        /usr/local/ejabberd/bin/IperExternModule/dispatch_daemon[0x8048681]


Even though the tcsetpgrp errors which disappear when the Suid bit is
set on the daemon, realloc keeps raising an error just like here.
By the way, gdb told me 0x09d79008 is the value of the data pointer, not
the new size as the error message lead me to think at first.

And finally, it appears that using su to log as ejabberd, then starting
the daemon doesn't raise the error, as opposed to su -c.


I hope this report was of any use to you,
Cheers, Mathieu Sivade