From 0e80c788850c4a699e4bfb3ab7b44e354b8fdfd7 Mon Sep 17 00:00:00 2001
From: Christian Göttsche <cgzones@googlemail.com>
Date: Tue, 16 Jan 2024 15:12:58 +0100
Subject: modules: zero out crypt_r(3) data before usage

The manual page of crypt_r(3) recommends to zero the entire data object.
---
 modules/pam_unix/bigcrypt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'modules/pam_unix/bigcrypt.c')

diff --git a/modules/pam_unix/bigcrypt.c b/modules/pam_unix/bigcrypt.c
index be7cdb93..1b32c3f2 100644
--- a/modules/pam_unix/bigcrypt.c
+++ b/modules/pam_unix/bigcrypt.c
@@ -67,12 +67,11 @@ char *bigcrypt(const char *key, const char *salt)
 		return NULL;
 	}
 #ifdef HAVE_CRYPT_R
-	cdata = malloc(sizeof(*cdata));
+	cdata = calloc(1, sizeof(*cdata));
 	if(!cdata) {
 		free(dec_c2_cryptbuf);
 		return NULL;
 	}
-	cdata->initialized = 0;
 #endif
 
 	/* fill KEYBUF_SIZE with key */
-- 
cgit v1.2.3