From owner-freebsd-bugs Sun Aug 12 6:10: 7 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 7412537B40A for ; Sun, 12 Aug 2001 06:10:01 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.4/8.11.4) id f7CDA1q93572; Sun, 12 Aug 2001 06:10:01 -0700 (PDT) (envelope-from gnats) Received: from mgate10.so-net.ne.jp (mgate10.so-net.ne.jp [210.139.254.157]) by hub.freebsd.org (Postfix) with ESMTP id 3269437B40B for ; Sun, 12 Aug 2001 06:04:11 -0700 (PDT) (envelope-from sanewo@ba2.so-net.ne.jp) Received: from mail.ba2.so-net.ne.jp (mail.ba2.so-net.ne.jp [210.139.254.21]) by mgate10.so-net.ne.jp (8.9.3/3.7W01060506) with ESMTP id WAA26859 for ; Sun, 12 Aug 2001 22:04:10 +0900 (JST) Received: from ba2.so-net.ne.jp (pd301e9.tkyoea00.ap.so-net.ne.jp [61.211.1.233]) by mail.ba2.so-net.ne.jp with ESMTP id f7CD49s16519 for ; Sun, 12 Aug 2001 22:04:09 +0900 (JST) Received: (from sanewo@localhost) by ba2.so-net.ne.jp (8.11.5/8.11.5) id f7CD48503629; Sun, 12 Aug 2001 22:04:08 +0900 (JST) (envelope-from sanewo) Message-Id: <200108121304.f7CD48503629@ba2.so-net.ne.jp> Date: Sun, 12 Aug 2001 22:04:08 +0900 (JST) From: Takanori Saneto To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.113 Subject: bin/29645: pam_ssh bug causes xdm dumps core at the end of session Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 29645 >Category: bin >Synopsis: pam_ssh bug causes xdm dumps core at the end of session >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Aug 12 06:10:01 PDT 2001 >Closed-Date: >Last-Modified: >Originator: Takanori Saneto >Release: FreeBSD 5.0-CURRENT i386 >Organization: an individual >Environment: System: FreeBSD muse.sanewo 5.0-CURRENT FreeBSD 5.0-CURRENT #3: Fri Aug 10 08:39:44 JST 2001 root@:/export/usr.obj/usr/src/sys/MUSE i386 pam_ssh module as of today: FreeBSD: src/lib/libpam/modules/pam_ssh/pam_ssh.c,v 1.16 2001/08/11 12:37:55 markm Exp /etc/pam.conf: xdm auth requisite pam_cleartext_pass_ok.so xdm auth required pam_nologin.so xdm auth sufficient pam_ssh.so try_first_pass xdm auth required pam_unix.so xdm account required pam_unix.so xdm session optional pam_ssh.so xdm session required pam_deny.so xdm password required pam_deny.so >Description: With above configratuin, xdm dumps core at the end of session. This is due to free()ing non-malloc()ed memory in pam's session cleanup code. The data being free()ed is the one passed to pam_set_data() in pam_ssh and it is not a malloc()ed chunk, but a part of an array. >How-To-Repeat: Login to xdm and then logout. >Fix: Index: pam_ssh.c =================================================================== RCS file: /export/cvsup/cvs/src/lib/libpam/modules/pam_ssh/pam_ssh.c,v retrieving revision 1.16 diff -u -r1.16 pam_ssh.c --- pam_ssh.c 2001/08/11 12:37:55 1.16 +++ pam_ssh.c 2001/08/12 12:24:55 @@ -405,6 +405,11 @@ } else if (strcmp(&env_string[strlen(env_string) - strlen(ENV_PID_SUFFIX)], ENV_PID_SUFFIX) == 0) { + env_value = strdup(env_value); + if (env_value == NULL) { + syslog(LOG_CRIT, "%s: %m", MODULE_NAME); + PAM_RETURN(PAM_SERVICE_ERR); + } retval = pam_set_data(pamh, "ssh_agent_pid", env_value, ssh_cleanup); if (retval != PAM_SUCCESS) >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message