freebsd-dev/lib/libpam
Yan Ka Chiu b75e0eed34 pam_exec: fix segfault when authtok is null
According to pam_exec(8), the `expose_authtok` option should be ignored
when the service function is `pam_sm_setcred`. Currently `pam_exec` only
prevent prompt for anth token when `expose_authtok` is set on
`pam_sm_setcred`. This subsequently led to segfault when there isn't an
existing auth token available.

Bug reported on this: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263893

After reading https://reviews.freebsd.org/rS349556 I am not sure if the
default behaviour supposed to be simply not prompt for authentication
token, or is it to ignore the option entirely as stated in the man page.

This patch is therefore only adding an additional NULL check on the item
`pam_get_item` provide, and exit with `PAM_SYSTEM_ERR` when such item is
NULL.

MFC after:	1 week
Reviewed by:	des, khng
Differential Revision:	https://reviews.freebsd.org/D35169
2022-05-22 12:36:48 -04:00
..
libpam pam: add option to not prompt for password if it's set to empty 2021-04-03 13:05:50 +01:00
modules pam_exec: fix segfault when authtok is null 2022-05-22 12:36:48 -04:00
pam.d pkgbase: Put more binaries/lib in runtime 2021-12-21 10:17:27 +01:00
static_libpam
Makefile
Makefile.inc