[gdm] worker: Fix memory corruption error/crasher



commit 9755ca3a594a01ba7f361684af1c29b49be17856
Author: Michel Dänzer <michel daenzer net>
Date:   Tue Aug 20 11:25:00 2013 -0400

    worker: Fix memory corruption error/crasher
    
    gdm_session_worker_process_pam_message() contains this code:
    
                             *response_text = strndup (user_answer,
    PAM_MAX_RESP_SIZE - 1);
                            (*response_text)[PAM_MAX_RESP_SIZE - 1] = '\0';
    
    If the string pointed to by user_answer is shorter than PAM_MAX_RESP_SIZE - 1
    (which will generally be the case), the second line clobbers unrelated memory.
    On this powerpc laptop, that causes gdm-session-worker to crash while verifying
    the password, leaving me unable to log into any user session.
    
    strndup() already ensures that the resulting string is 0-terminated anyway, so
    this commit just removes the second line.

 daemon/gdm-session-worker.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)
---
diff --git a/daemon/gdm-session-worker.c b/daemon/gdm-session-worker.c
index 422c6ef..7307872 100644
--- a/daemon/gdm-session-worker.c
+++ b/daemon/gdm-session-worker.c
@@ -795,7 +795,6 @@ gdm_session_worker_process_pam_message (GdmSessionWorker          *worker,
                  */
                 if (res && response_text != NULL) {
                         *response_text = strndup (user_answer, PAM_MAX_RESP_SIZE - 1);
-                        (*response_text)[PAM_MAX_RESP_SIZE - 1] = '\0';
                 }
 
                 memset (user_answer, '\0', strlen (user_answer));


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]