fix: memory leak of ngrp in updates_groups()

[savoptik]

In src/userdel.c:update_groups(), the 'ngrp' pointer was not freed
after use, leading to a memory leak. Added free(ngrp) call.

In src/userdel.c:update_groups(), the 'nsgrp' pointer was not freed
between loop iterations, leading to cumulative memory leaks. Added
free(nsgrp) call before proceeding to next iteration.

[alejandro-colomar]

From the commit message:

, producing a
use-after-free and an invalid free in the subsequent gr_update() /
sgr_update() call.

Does gr_update() free the input? If so, I'd appreciate some more detailed analysis, as this code is difficult to follow.

[savoptik]

Both of these calls lead to lib/commonio.c int commonio_update (struct commonio_db *db, const void *eptr).
In different execution paths, the cleanup function ```db->ops->cio_free()```` is called.

[alejandro-colomar]

Both of these calls lead to lib/commonio.c int commonio_update (struct commonio_db *db, const void *eptr).

Yup.

alx@devuan:~/src/shadow/shadow/master$ grepc -h -tfd gr_update .
int gr_update (const struct group *gr)
{
	return commonio_update (&group_db, gr);
}
alx@devuan:~/src/shadow/shadow/master$ grepc -h -tfd sgr_update .
int sgr_update (const struct sgrp *sg)
{
	return commonio_update (&gshadow_db, sg);
}

In different execution paths, the cleanup function ```db->ops->cio_free()```` is called.

Yup, ...->cio_free() ends up being called, but it seems to be called on memory allocated within the function itself, AFAICS.

alx@devuan:~/src/shadow/shadow/master$ grepc -h -tfd commonio_update . | grep -e '^\w' -e cio_free
int commonio_update (struct commonio_db *db, const void *eptr)
			db->ops->cio_free(nentry);
		db->ops->cio_free(p->eptr);
		db->ops->cio_free(nentry);

If that memory points to memory owned by the caller, at least it's not obvious to me (but this function is hard to read, so it could be).

[alejandro-colomar]

Please separate the last commit message in two. Also, please move the comments into the commit message and remove them from the source code.

[savoptik]

Could you please clarify what you mean by “splitting the commit message”?

Also, I’ve removed the comments you pointed out — do you mean I should remove all comments from the code, or just the ones we discussed?

[alejandro-colomar]

Could you please clarify what you mean by “splitting the commit message”?

Oops, I meant the commit, not commit message. :)

Also, I’ve removed the comments you pointed out — do you mean I should remove all comments from the code, or just the ones we discussed?

The existing comments don't need to be removed. I remove them when modifying the related code enough, and otherwise leave them.

But I'm quite averse to adding new source-code comments.

[savoptik]

I removed all comments from the source code in all my commits.

Are you sure the last (8th) commit needs to be split?

[alejandro-colomar]

Yes, please; those are two different leaks. Thanks!

[savoptik]

done