Date: Wed, 8 Nov 2000 07:10:02 +0900 (JST) From: sanewo@ba2.so-net.ne.jp To: FreeBSD-gnats-submit@freebsd.org Subject: bin/22670: yet another pam_ssh core dump Message-ID: <200011072210.eA7MA2504427@ba2.so-net.ne.jp>
next in thread | raw e-mail | index | archive | help
>Number: 22670 >Category: bin >Synopsis: pam_ssh dumps core due to bug in env_destroy() >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Nov 07 14:20:04 PST 2000 >Closed-Date: >Last-Modified: >Originator: Takanori Saneto >Release: FreeBSD 5.0-CURRENT i386 >Organization: an individual >Environment: System: FreeBSD muse.sanewo 5.0-CURRENT FreeBSD 5.0-CURRENT #1: Wed Nov 8 00:26:46 JST 2000 sanewo@muse.sanewo:/sd1/obj/usr/src/sys/MUSE i386 pam_ssh.c as of 2000/11/08 >Description: env_destroy() in pam_ssh.c sets garbage to environ when called before env_commit(), which may cause core dump later in the application. >How-To-Repeat: Under xdm+pam environment, when ssh-agent invocation fail (because of missing /dev/random, etc.) , xdm dumps core. >Fix: following patch (in conjunction with PR bin/22614 patch) should fix the problem. diff -u -r1.8 pam_ssh.c --- pam_ssh.c 2000/07/16 05:52:28 1.8 +++ pam_ssh.c 2000/11/07 22:01:45 @@ -176,7 +176,8 @@ { struct env_entry *p; - env_swap(self, 0); + if (self->e_committed) + env_swap(self, 0); SLIST_FOREACH(p, &self->e_head, ee_entries) { free(p->ee_env); free(p); >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200011072210.eA7MA2504427>