Date: Wed, 8 Nov 2000 07:10:02 +0900 (JST) From: sanewo@ba2.so-net.ne.jp To: FreeBSD-gnats-submit@freebsd.org Subject: bin/22670: yet another pam_ssh core dump Message-ID: <200011072210.eA7MA2504427@ba2.so-net.ne.jp>
next in thread | raw e-mail | index | archive | help
>Number: 22670
>Category: bin
>Synopsis: pam_ssh dumps core due to bug in env_destroy()
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Nov 07 14:20:04 PST 2000
>Closed-Date:
>Last-Modified:
>Originator: Takanori Saneto
>Release: FreeBSD 5.0-CURRENT i386
>Organization:
an individual
>Environment:
System: FreeBSD muse.sanewo 5.0-CURRENT FreeBSD 5.0-CURRENT #1: Wed Nov 8 00:26:46 JST 2000 sanewo@muse.sanewo:/sd1/obj/usr/src/sys/MUSE i386
pam_ssh.c as of 2000/11/08
>Description:
env_destroy() in pam_ssh.c sets garbage to environ when called before env_commit(),
which may cause core dump later in the application.
>How-To-Repeat:
Under xdm+pam environment, when ssh-agent invocation fail (because of missing /dev/random, etc.)
, xdm dumps core.
>Fix:
following patch (in conjunction with PR bin/22614 patch) should fix the problem.
diff -u -r1.8 pam_ssh.c
--- pam_ssh.c 2000/07/16 05:52:28 1.8
+++ pam_ssh.c 2000/11/07 22:01:45
@@ -176,7 +176,8 @@
{
struct env_entry *p;
- env_swap(self, 0);
+ if (self->e_committed)
+ env_swap(self, 0);
SLIST_FOREACH(p, &self->e_head, ee_entries) {
free(p->ee_env);
free(p);
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200011072210.eA7MA2504427>