Minimal vulnerable example for CVE-2021-4034

pkexamp.c

// cc -o pkexamp pkexamp.c $(pkg-config --cflags --libs glib-2.0) && \
//  sudo sh -c "chown 0:0 pkexamp && chmod u+s pkexamp"

#include <stdlib.h>
#include <stdio.h>
#include <glib.h>

int main(int argc, char **argv, char **envp)
{
	gchar *path = NULL, *s;
	char **sp;
	int ret = EXIT_FAILURE;
	if (argc == 1) { // not <=:)
		g_printerr("program to execute required!\n");
		goto out;
	}
	path = g_strdup(argv[1]);
	if (path[0] != '/') {
		s = g_find_program_in_path(path);
		if (!s) {
			g_printerr("program not found: %s\n", path);
			goto out;
		}
		g_free(path);
		path = s;	
	}
	argv[1] = path;
	fputs("Arguments:\n", stderr);
	for (sp = argv; *sp; sp++) fprintf(stderr, "  %s\n", *sp);
	fputs("Environment:\n", stderr);
	for (sp = envp; *sp; sp++) fprintf(stderr, "  %s\n", *sp);
	// GLib victim to call into iconv_open()
	g_print("Pretending to execute %s...\n", path);
	ret = 0;
out:
	if (path) g_free(path);
	return ret;
}