diff options
| author | Keith Turner - C72473 <Keith.Turner2@microchip.com> | 2024-09-06 10:45:37 -0700 |
|---|---|---|
| committer | Dmitry V. Levin <ldv@strace.io> | 2024-09-10 08:00:00 +0000 |
| commit | 5f0b5b2def617c50034422c5bc112509d7f5652e (patch) | |
| tree | 56862d5196b20a1793d5f9f17b930a15b2259d8e /modules | |
| parent | f5db2603d2ce80a610a247e06bdd49c4eb091a7d (diff) | |
| download | pam-5f0b5b2def617c50034422c5bc112509d7f5652e.tar.gz pam-5f0b5b2def617c50034422c5bc112509d7f5652e.tar.bz2 pam-5f0b5b2def617c50034422c5bc112509d7f5652e.zip | |
pam_userdb: don't overwrite free'd memory
As crypt_r is expected to return a pointer into a provided crypt_data
struct, callers should not modify the string returned by crypt_r after
freeing the corresponding crypt_data struct.
Co-authored-by: Dmitry V. Levin <ldv@strace.io>
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/pam_userdb/pam_userdb.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/modules/pam_userdb/pam_userdb.c b/modules/pam_userdb/pam_userdb.c index 40ede6de..e5942c8a 100644 --- a/modules/pam_userdb/pam_userdb.c +++ b/modules/pam_userdb/pam_userdb.c @@ -268,11 +268,6 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode, } if (cryptmode && pam_str_skip_icase_prefix(cryptmode, "crypt") != NULL) { - - /* crypt(3) password storage */ - - char *cryptpw = NULL; - if (data.dsize < 13) { /* hash is too short */ pam_syslog(pamh, LOG_INFO, "password hash in database is too short"); @@ -286,6 +281,7 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode, if (pwhash == NULL) { pam_syslog(pamh, LOG_CRIT, "strndup failed: data.dptr"); } else { + char *cryptpw = NULL; #ifdef HAVE_CRYPT_R struct crypt_data *cdata = NULL; cdata = calloc(1, sizeof(*cdata)); @@ -312,13 +308,13 @@ user_lookup (pam_handle_t *pamh, const char *database, const char *cryptmode, #ifdef HAVE_CRYPT_R pam_overwrite_object(cdata); free(cdata); +#else + pam_overwrite_string(cryptpw); #endif } pam_overwrite_string(pwhash); free(pwhash); } - - pam_overwrite_string(cryptpw); } else { /* Unknown password encryption method - |