Date: Sun, 10 Feb 2019 17:59:51 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 235647] pam_verror may cause segmentation fault Message-ID: <bug-235647-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D235647 Bug ID: 235647 Summary: pam_verror may cause segmentation fault Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: misc Assignee: bugs@FreeBSD.org Reporter: hoomanfazaeli@gmail.com The pam_verror may cause segmentation fault. Consider the following scenario: 1. A service module (for instance, pam_unix) calls PAM_VERBOSE_ERROR. That macro expands to _pam_verbose_error call. 2. _pam_verbose_error calls pam_verror if the PAM_SILENT flag is not=20 set on the PAM handle and no_warn option is not set for the service=20 module. 3. pam_verror allocates 'char *rsp' on stack w/o initializing it to NULL, (a dangling pointer), and makes=20 pam_vprompt(pamh, PAM_ERROR_MSG, &rsp, fmt, ap) call.=20 4. Now if the the PAM conversation is NULL, pam_vprompt soon returns=20 w/ PAM_SYSTEM_ERR and __does not__ set *rsp.=20 5. pam_verror then does FREE(rsp) and if rsp happens to be anything other=20 than NULL, a segmentation fault happens. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-235647-227>