Date: Sun, 12 Aug 2001 22:04:08 +0900 (JST) From: Takanori Saneto <sanewo@ba2.so-net.ne.jp> To: FreeBSD-gnats-submit@freebsd.org Subject: bin/29645: pam_ssh bug causes xdm dumps core at the end of session Message-ID: <200108121304.f7CD48503629@ba2.so-net.ne.jp>
next in thread | raw e-mail | index | archive | help
>Number: 29645
>Category: bin
>Synopsis: pam_ssh bug causes xdm dumps core at the end of session
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Aug 12 06:10:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Takanori Saneto
>Release: FreeBSD 5.0-CURRENT i386
>Organization:
an individual
>Environment:
System: FreeBSD muse.sanewo 5.0-CURRENT FreeBSD 5.0-CURRENT #3: Fri Aug 10 08:39:44 JST 2001 root@:/export/usr.obj/usr/src/sys/MUSE i386
pam_ssh module as of today:
FreeBSD: src/lib/libpam/modules/pam_ssh/pam_ssh.c,v 1.16 2001/08/11 12:37:55 markm Exp
/etc/pam.conf:
xdm auth requisite pam_cleartext_pass_ok.so
xdm auth required pam_nologin.so
xdm auth sufficient pam_ssh.so try_first_pass
xdm auth required pam_unix.so
xdm account required pam_unix.so
xdm session optional pam_ssh.so
xdm session required pam_deny.so
xdm password required pam_deny.so
>Description:
With above configratuin, xdm dumps core at the end of session.
This is due to free()ing non-malloc()ed memory in pam's session cleanup code.
The data being free()ed is the one passed to pam_set_data() in pam_ssh and it
is not a malloc()ed chunk, but a part of an array.
>How-To-Repeat:
Login to xdm and then logout.
>Fix:
Index: pam_ssh.c
===================================================================
RCS file: /export/cvsup/cvs/src/lib/libpam/modules/pam_ssh/pam_ssh.c,v
retrieving revision 1.16
diff -u -r1.16 pam_ssh.c
--- pam_ssh.c 2001/08/11 12:37:55 1.16
+++ pam_ssh.c 2001/08/12 12:24:55
@@ -405,6 +405,11 @@
}
else if (strcmp(&env_string[strlen(env_string) -
strlen(ENV_PID_SUFFIX)], ENV_PID_SUFFIX) == 0) {
+ env_value = strdup(env_value);
+ if (env_value == NULL) {
+ syslog(LOG_CRIT, "%s: %m", MODULE_NAME);
+ PAM_RETURN(PAM_SERVICE_ERR);
+ }
retval = pam_set_data(pamh, "ssh_agent_pid",
env_value, ssh_cleanup);
if (retval != PAM_SUCCESS)
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200108121304.f7CD48503629>