From 4a13c45081cfcbaa1ba738c05db1ea4d5f99c73f Mon Sep 17 00:00:00 2001
From: Fabrice Bellard <fabrice@bellard.org>
Date: Mon, 1 Jun 2026 18:47:42 +0200
Subject: [PATCH] fixed setuid() / setgid() ordering (#517)

---
 quickjs-libc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/quickjs-libc.c b/quickjs-libc.c
index de860f7..bd671b6 100644
--- a/quickjs-libc.c
+++ b/quickjs-libc.c
@@ -3305,14 +3305,14 @@ static JSValue js_os_exec(JSContext *ctx, JSValueConst this_val,
             if (chdir(cwd) < 0)
                 _exit(127);
         }
-        if (uid != -1) {
-            if (setuid(uid) < 0)
-                _exit(127);
-        }
         if (gid != -1) {
             if (setgid(gid) < 0)
                 _exit(127);
         }
+        if (uid != -1) {
+            if (setuid(uid) < 0)
+                _exit(127);
+        }
 
         if (!file)
             file = exec_argv[0];