From bbd8212ced411754df21c8fb53f704c8cfdf5758 Mon Sep 17 00:00:00 2001
From: wsxarcher <marco.bartoli.dev@gmail.com>
Date: Sun, 28 Jun 2026 17:18:05 +0200
Subject: [PATCH] Fix UAF of PS1

---
 Source/Tools/FEXBash/FEXBash.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Source/Tools/FEXBash/FEXBash.cpp b/Source/Tools/FEXBash/FEXBash.cpp
index ebf43d593..ccd9c1319 100644
--- a/Source/Tools/FEXBash/FEXBash.cpp
+++ b/Source/Tools/FEXBash/FEXBash.cpp
@@ -97,7 +97,9 @@ int main(int argc, char** argv, char** const envp) {
       Envp.emplace_back(envp[i]);
     }
   }
-  Envp.emplace_back(EnchantedPS1(PS1Env).c_str());
+  // Keep the string alive until after execve.
+  const std::string PS1 = EnchantedPS1(PS1Env);
+  Envp.emplace_back(PS1.c_str());
   Envp.emplace_back(nullptr);
 
   return execve(Argv[0], const_cast<char* const*>(Argv.data()), const_cast<char* const*>(&Envp[0]));