[SSSD] [PATCH] Do not try to set password when authtok_length is zero

Jakub Hrozek jhrozek at redhat.com
Tue Jul 9 21:15:09 UTC 2013


On Fri, Jun 28, 2013 at 02:23:01PM +0200, Lukas Slebodnik wrote:
> On (24/06/13 17:04), Ondrej Kos wrote:
> >The problem here wasn't in returned error code, but in faultly read
> >DBUS message, due to condition in sss_authtok_set_string.
> >
> >When password is empty, it passes 0 as length, which is
> >misinterpreted, and the function tries to determine the length of
> >string by itself, reaching over boundaries of authtok string.
> >
> >trac issue: https://fedorahosted.org/sssd/ticket/1814
> >
> >Patch is attached
> >
> >Ondra
> 
> We found out that it is right approach (after long discussion :-)
> 
> ACK

The approach might be good but on entering a blank password I'm getting
"System Error" with this patch, while without the patch I was getting
"Authentication failure". PAM_AUTH_ERR is the correct return code for
this use case.



More information about the sssd-devel mailing list