rpms/pam
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- fix segfault in faillock utility

Browse Source 
- remove some cases where the information of existence of
  an user account could be leaked by the pam_faillock,
  document the remaining case
This commit is contained in:
Tomas Mraz 2010-11-10 17:15:18 +01:00
parent 5310fecf62
commit fdfa166654
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pam-1.1.3-faillock-screensaver.patch
View File

@ -17,11 +17,13 @@ diff -up Linux-PAM-1.1.3/modules/pam_faillock/faillock.c.screensaver Linux-PAM-1
{ {
char *path; char *path;
int flags = O_RDWR; int flags = O_RDWR;
@@ -69,8 +70,16 @@ open_tally (const char *dir, const char @@ -69,8 +70,18 @@ open_tally (const char *dir, const char
fd = open(path, flags, 0600); fd = open(path, flags, 0600);
- if (fd != -1) - if (fd != -1)
+ free(path);
+
+ if (fd != -1) { + if (fd != -1) {
+ struct stat st; + struct stat st;
+ +

5
pam.spec
View File

@ -3,7 +3,7 @@
Summary: An extensible library which provides authentication for applications Summary: An extensible library which provides authentication for applications
Name: pam Name: pam
Version: 1.1.3 Version: 1.1.3
Release: 3%{?dist} Release: 4%{?dist}
# The library is BSD licensed with option to relicense as GPLv2+ - this option is redundant # The library is BSD licensed with option to relicense as GPLv2+ - this option is redundant
# as the BSD license allows that anyway. pam_timestamp and pam_console modules are GPLv2+, # as the BSD license allows that anyway. pam_timestamp and pam_console modules are GPLv2+,
License: BSD and GPLv2+ License: BSD and GPLv2+
@ -345,6 +345,9 @@ fi
%doc doc/adg/*.txt doc/adg/html %doc doc/adg/*.txt doc/adg/html
%changelog %changelog
* Wed Nov 10 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-4
- fix memory leak in pam_faillock
* Wed Nov 10 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-3 * Wed Nov 10 2010 Tomas Mraz <tmraz@redhat.com> 1.1.3-3
- fix segfault in faillock utility - fix segfault in faillock utility
- remove some cases where the information of existence of - remove some cases where the information of existence of