From 0e80c788850c4a699e4bfb3ab7b44e354b8fdfd7 Mon Sep 17 00:00:00 2001
From: Christian Göttsche <cgzones@googlemail.com>
Date: Tue, 16 Jan 2024 15:12:58 +0100
Subject: modules: zero out crypt_r(3) data before usage

The manual page of crypt_r(3) recommends to zero the entire data object.
---
 modules/pam_pwhistory/opasswd.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

(limited to 'modules/pam_pwhistory')

diff --git a/modules/pam_pwhistory/opasswd.c b/modules/pam_pwhistory/opasswd.c
index b7711e03..a4bcbaae 100644
--- a/modules/pam_pwhistory/opasswd.c
+++ b/modules/pam_pwhistory/opasswd.c
@@ -127,9 +127,7 @@ compare_password(const char *newpass, const char *oldpass)
   char *outval;
   int retval;
 #ifdef HAVE_CRYPT_R
-  struct crypt_data output;
-
-  output.initialized = 0;
+  struct crypt_data output = { 0 };
 
   outval = crypt_r (newpass, oldpass, &output);
 #else
-- 
cgit v1.2.3