On Mon, Jan 23, 2017 at 10:30:05AM +0100, Tomas Mraz wrote:
On Mon, 2017-01-23 at 11:02 +0300, Dmitry V. Levin wrote:
> From: Daniel Abrecht <daniel.abrecht(a)hotmail.com>
>
> Fix a null pointer dereference when pam_prompt returns PAM_SUCCESS
> but the response is set to NULL.
>
> * modules/pam_exec/pam_exec.c (call_exec): Do not invoke strndupa
> with a null pointer.
>
> Closes:
https://github.com/linux-pam/linux-pam/pull/2
> ---
> modules/pam_exec/pam_exec.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/modules/pam_exec/pam_exec.c
> b/modules/pam_exec/pam_exec.c
> index f7de1aa..52dc681 100644
> --- a/modules/pam_exec/pam_exec.c
> +++ b/modules/pam_exec/pam_exec.c
> @@ -177,9 +177,12 @@ call_exec (const char *pam_type, pam_handle_t
> *pamh,
> return retval;
> }
>
> - pam_set_item (pamh, PAM_AUTHTOK, resp);
> - authtok = strndupa (resp, PAM_MAX_RESP_SIZE);
> - _pam_drop (resp);
> + if (resp)
> + {
> + pam_set_item (pamh, PAM_AUTHTOK, resp);
> + authtok = strndupa (resp, PAM_MAX_RESP_SIZE);
> + _pam_drop (resp);
> + }
> }
> else
> authtok = strndupa (void_pass, PAM_MAX_RESP_SIZE);
This looks OK, please apply.
Should we change our mode of operation as we moved to GitHub? I mean
should we use the GitHub pull requests for review?
Personally, I find GitHub pull requests model inconvenient because it
assumes that I use a browser for handling emails, which is certainly
not the case. In other words, I can handle GitHub pull requests,
but I wouldn't encourage people to use them instead of traditional
patch submissions.
--
ldv