From nobody@FreeBSD.org  Wed Sep  5 14:33:43 2001
Return-Path: <nobody@FreeBSD.org>
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id CC9A537B407
	for <freebsd-gnats-submit@FreeBSD.org>; Wed,  5 Sep 2001 14:33:43 -0700 (PDT)
Received: (from nobody@localhost)
	by freefall.freebsd.org (8.11.4/8.11.4) id f85LXhF25302;
	Wed, 5 Sep 2001 14:33:43 -0700 (PDT)
	(envelope-from nobody)
Message-Id: <200109052133.f85LXhF25302@freefall.freebsd.org>
Date: Wed, 5 Sep 2001 14:33:43 -0700 (PDT)
From: Edward Counce <edward.counce@celion.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: core dump in libpam.so when parsing config file
X-Send-Pr-Version: www-1.0

>Number:         30357
>Category:       bin
>Synopsis:       core dump in libpam.so when parsing config file
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 05 14:40:02 PDT 2001
>Closed-Date:    Thu Sep 13 01:26:04 PDT 2001
>Last-Modified:  Thu Sep 13 01:27:01 PDT 2001
>Originator:     Edward Counce
>Release:        4.3-RELEASE
>Organization:
Celion Networks, Inc.
>Environment:
FreeBSD ecounce 4.3-RELEASE FreeBSD 4.3-RELEASE #0: Sat Apr 21 10:54:49 GMT 2001     jkh@narf.osd.bsdi.com:/usr/src/sys/compile/GENERIC  i386
>Description:
While parsing the configuration file, numeric (jump) actions in the newer control flag syntax may cause a core dump.

>How-To-Repeat:
add to /etc/pam.conf:

sshd auth [success=1 default=ignore] pam_tacplus.so

>Fix:
Index: pam_misc.c
===================================================================
RCS file: /home/ncvs/src/contrib/libpam/libpam/pam_misc.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 pam_misc.c
--- pam_misc.c  18 Nov 1998 01:16:19 -0000      1.1.1.1
+++ pam_misc.c  5 Sep 2001 21:16:36 -0000
@@ -278,7 +278,7 @@
        }

        /* observe action type */
-       for (act=0; act<=-_PAM_ACTION_UNDEF; ++act) {
+       for (act=0; act<-_PAM_ACTION_UNDEF; ++act) {
            len = strlen(_pam_token_actions[act]);
            if (!strncmp(_pam_token_actions[act], tok, len)) {
                act *= -1;
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: roam 
State-Changed-When: Thu Sep 13 01:26:04 PDT 2001 
State-Changed-Why:  
I just committed to -stable a similar fix taken from the newer 
PAM sources in -current. 

Thank you for the PR! 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=30357 
>Unformatted:
