Page:
Errata 2023 06 27 a
Pages
Errata 2011 11 08
Errata 2013 03 04
Errata 2014 02 26
Errata 2014 06 02
Errata 2014 10 22
Errata 2017 01 18
Errata 2017 02 19
Errata 2019 02 22
Errata 2023 06 27 a
Errata 2023 06 27 b
Errata
History
Home
MigrationToSubversionAndTrac
ObtainingAndInstalling
Releases Calamite
Releases Caliopsis
Releases Cantaloupe
Releases Celandine
Releases Centaury
Releases Checklist
Releases Cinchona
Releases Cineraria
Releases Cinnamon
Releases Cinquefoil
Releases Citronella
Releases Cyclamen
Releases Daffodil
Releases Dianthus
Releases Digitalis
Releases Dogwood
Releases Eelgrass
Releases Feterita
Releases Figwort
Releases Hydrangea
Releases Lycopsida
Releases Micrampelis
Releases Nummularia
Releases Ourouparia
Releases Radula
Releases Resedacea
Releases Tabebuia
Releases Ximenia
Releases
No results
2
Errata 2023 06 27 a
Dag-Erling Smørgrav edited this page 2023-06-26 18:59:21 +00:00
Table of Contents
Errata: Null pointer dereference in openpam_set_option()
Date:: 2023-06-27
Affects:: All releases prior to Ximenia
Description:: When removing an option, openpam_set_option()
failed to decrement optc
, causing subsequent calls to potentially pass a null pointer to strncmp()
, resulting in a crash.
Workaround:: None.
Fix:: Upgrade to OpenPAM Ximenia. If you are unable or unwilling to upgrade, apply the following patch:
--- lib/libpam/openpam_set_option.c.orig
+++ lib/libpam/openpam_set_option.c
@@ -83,6 +83,7 @@ openpam_set_option(pam_handle_t *pamh,
for (free(cur->optv[i]); i < cur->optc; ++i)
cur->optv[i] = cur->optv[i + 1];
cur->optv[i] = NULL;
+ --cur->optc;
RETURNC(PAM_SUCCESS);
}
if (asprintf(&opt, "%.*s=%s", (int)len, option, value) < 0)