<div style="line-height:1.7;color:#000000;font-size:14px;font-family:Arial"><p id="yui_3_10_3_1_1619869692788_1497" style="margin: 0px 0px 1.2em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">In the source code update-<wbr>notifier_<wbr>3.192.40.<wbr>tar.xz, when there is file /var/lib/<wbr>update-<wbr>notifier/<wbr>user.d/<wbr>incomplete-<wbr>language-<wbr>support-<wbr>gnome.note.</p><p style="margin: 0px 0px 1.2em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">In hooks.c, at line 108, when the file test is true, the program will execute "goto out" at line 112.</p><div style="margin: 0px 0px 1.2em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Then at line 137, pathdirs is in uninitialized state and triggers a segmentation fault in g_strfreev().</div><div style="margin: 0px 0px 1.2em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><br></div><div style="margin: 0px 0px 1.2em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><p id="yui_3_10_3_1_1619869692788_1508" style="margin: 0px 0px 0.8em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">if(cargv[0][0] == '/' &&<br>  g_file_<wbr>test(cargv[<wbr>0], G_FILE_<wbr>TEST_EXISTS|<wbr>G_FILE_<wbr>TEST_IS_<wbr>EXECUTABLE)<wbr>) {<br>      result = TRUE;<br>      g_<wbr>debug_hooks(<wbr>"command exists");<br>      goto out; // THIS IS EXECUTED<br>   }</p><p style="margin: 0px 0px 0.8em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">   g_debug_<wbr>hooks("<wbr>'%s' is not a valid absolute path", cargv[0]);</p><p style="margin: 0px 0px 0.8em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">   gchar **pathdirs = g_strsplit(<wbr>getenv(<wbr>"PATH")<wbr>, ":", 100);<br>   if(!pathdirs) goto out;</p><p style="margin: 0px 0px 0.8em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">   for(int i = 0; pathdirs[i] != NULL; i++) {<br>      gchar *pathdir = pathdirs[i];<br>      char *fname = g_strdup_<wbr>printf(<wbr>"%s/%s"<wbr>, pathdir, cargv[0]);<br>      if(<wbr>g_file_<wbr>test(fname, G_FILE_<wbr>TEST_EXISTS|<wbr>G_FILE_<wbr>TEST_IS_<wbr>EXECUTABLE)<wbr>) {<br>  g_debug_<wbr>hooks("<wbr>command exists at '%s'", fname);<br>  g_free(fname);<br>  result = TRUE;<br>  goto out;<br>      }<br>      g_<wbr>free(fname)<wbr>;<br>   }</p><p style="margin: 0px 0px 0.8em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">   g_debug_<wbr>hooks("<wbr>failed to find command in PATH");</p><p id="yui_3_10_3_1_1619869692788_1513" style="margin: 0px 0px 0.8em; padding: 0px; width: auto; max-width: 45em; color: rgb(51, 51, 51); font-family: monospace; font-size: 12px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">out:<br>   if(error) g_error_<wbr>free(error)<wbr>;<br>   if(cargv) g_strfreev(cargv);<br>   if(pathdirs) g_strfreev(<wbr>pathdirs)<wbr>; // THIS IS THE CRASH SITE BECAUSE pathdirs IS IN UNINITIALIZED STATE.<br>   if(unquoted) g_free(unquoted);<br>   return result;</p></div></div>