Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 26 Jun 2023 17:20:10 +0000
From:      bugzilla-noreply@freebsd.org
To:        bugs@FreeBSD.org
Subject:   [Bug 272226] libpam's openpam_set_option() omits decrement of cur->optc, can lead to NULL dereference
Message-ID:  <bug-272226-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | raw e-mail 

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=272226

            Bug ID: 272226
           Summary: libpam's openpam_set_option() omits decrement of
                    cur->optc, can lead to NULL dereference
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

The code in libpam's openpam_set_option() that removes an option:

        if (value == NULL) {
                /* remove */
                if (i == cur->optc)
                        RETURNC(PAM_SUCCESS);
                for (free(cur->optv[i]); i < cur->optc; ++i)
                        cur->optv[i] = cur->optv[i + 1];
                cur->optv[i] = NULL;
                RETURNC(PAM_SUCCESS);
        }

It's missing a final "cur->optc -= 1", which can cause a subsequent
openpam_get_option() to crash when it runs off the end of cur->optv[]
and passes the terminal NULL to strncmp().

-- 
You are receiving this mail because:
You are the assignee for the bug.
home | help

Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-272226-227>