Submitted here: https://github.com/freebsd/atf/pull/57

From 098b66269b1cf1d944b8b214ceb7ce9febde3682 Mon Sep 17 00:00:00 2001
From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Date: Mon, 29 Jan 2024 22:35:49 -0500
Subject: [PATCH] Fix use after free in execute_with_shell.

The temporary string returned by atf::env::get would be used outside
its statement, which is invalid and cause undefined behavior.  Copy it
to a local variable to avoid the issue.

Fixes: https://github.com/freebsd/atf/issues/26
Fixes: https://github.com/freebsd/kyua/issues/223

Reported-by: Ruslan Bukin <br@bsdpad.com>
---
 atf-sh/atf-check.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/atf-sh/atf-check.cpp b/atf-sh/atf-check.cpp
index 41f0b13..9d6f7a8 100644
--- a/atf-sh/atf-check.cpp
+++ b/atf-sh/atf-check.cpp
@@ -436,7 +436,9 @@ execute_with_shell(char* const* argv)
     const std::string cmd = flatten_argv(argv);
 
     const char* sh_argv[4];
-    sh_argv[0] = atf::env::get("ATF_SHELL", ATF_SHELL).c_str();
+    const std::string shell = atf::env::get("ATF_SHELL", ATF_SHELL);
+
+    sh_argv[0] = shell.c_str();
     sh_argv[1] = "-c";
     sh_argv[2] = cmd.c_str();
     sh_argv[3] = NULL;

base-commit: 18eb8168b70a0f934b4824b6391b55ac0b2f4fdf
-- 
2.41.0

ix/log/tests/guix-package.sh'>
<select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/'>root</a>/<a href='/guix/log/tests'>tests</a>/<a href='/guix/log/tests/guix-package.sh'>guix-package.sh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/guix-package.sh?showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2024-12-14 00:34:28 +0100'>2024-12-14</span></td><td><a href='/guix/commit/tests/guix-package.sh?id=4a6ca998244f280958207e8ac15bae6e75943aca'>tests: guix-package: Fix guix package --search test.</a><span class='msg-avail'>...<span class='msg-tooltip'>This is a follow-up to commit
    6f8c8a86d827627f503a803381bce7fbcf8f39a0
    gnu: Fix synopsis in miscelaneous packages.

Change-Id: I5f44e07544f80973fa6b306b2dcdf42ac3b56ad6

* tests/guix-package.sh: Search for GNU hello's changed synopsis "Example GNU
package".

Change-Id: I79f606afee348cb6d57d9c0d08e15cd9267d5ceb
</span></span></td><td>Janneke Nieuwenhuizen</td></tr>
<tr><td><span title='2023-04-21 16:16:38 +0200'>2023-04-21</span></td><td><a href='/guix/commit/tests/guix-package.sh?id=37dd69b44511dc73eb04bdebe8d82c9a0386338e'>tests: Fix checks for expected failures.</a><span class='msg-avail'>...<span class='msg-tooltip'>Addresses &lt;https://issues.guix.gnu.org/62406&gt;.

With 'set -e', a return status inverted with '!' does not cause the shell to
exit immediately.  Instead use '&amp;&amp; false' to indicate an expected failure.

* tests/guix-archive.sh, tests/guix-build-branch.sh, tests/guix-build.sh,
tests/guix-daemon.sh, tests/guix-download.sh,
tests/guix-environment-container.sh, tests/guix-environment.sh,
tests/guix-gc.sh, tests/guix-git-authenticate.sh, tests/guix-graph.sh,
tests/guix-hash.sh, tests/guix-home.sh, tests/guix-pack-relocatable.sh,
tests/guix-pack.sh, tests/guix-package-aliases.sh, tests/guix-package-net.sh,
tests/guix-package.sh, tests/guix-refresh.sh, tests/guix-shell.sh,
tests/guix-style.sh, tests/guix-system.sh: Replace uses of '! ...' with
'... &amp;&amp; false' or `test ! ...` as appropriate.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Eric Bavier</td></tr>
<tr><td><span title='2022-12-20 16:56:03 +0100'>2022-12-20</span></td><td><a href='/guix/commit/tests/guix-package.sh?id=680970490c556ae0029aa1ba2b0faba162118186'>tests: Adjust 'guix package' test to latest package search metrics.</a><span class='msg-avail'>...<span class='msg-tooltip'>With commit bbcd06e56c06376e640a7ac81a7109e7135a20f2, the command
"guix package -s '^fileutils$'" would match the 'ocaml-fileutils'
package, because its 'package-upstream-name*' is "fileutils".  Work
around it.

Reported by Vagrant Cascadian.

* tests/guix-package.sh: Change "fileutils" example to use a different
package name.
</span></span></td><td>Ludovic Courtès</td></tr>