Date: Mon, 26 Jun 2023 17:20:10 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 272226] libpam's openpam_set_option() omits decrement of cur->optc, can lead to NULL dereference Message-ID: <bug-272226-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D272226 Bug ID: 272226 Summary: libpam's openpam_set_option() omits decrement of cur->optc, can lead to NULL dereference Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: bin Assignee: bugs@FreeBSD.org Reporter: rtm@lcs.mit.edu The code in libpam's openpam_set_option() that removes an option: if (value =3D=3D NULL) { /* remove */ if (i =3D=3D cur->optc) RETURNC(PAM_SUCCESS); for (free(cur->optv[i]); i < cur->optc; ++i) cur->optv[i] =3D cur->optv[i + 1]; cur->optv[i] =3D NULL; RETURNC(PAM_SUCCESS); } It's missing a final "cur->optc -=3D 1", which can cause a subsequent openpam_get_option() to crash when it runs off the end of cur->optv[] and passes the terminal NULL to strncmp(). --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-272226-227>