Bug#301204: libpam-ssh: pam-ssh incorrectly re-uses values returned by getpwnam()

2005-03-24 Thread Michael Tokarev
Package: libpam-ssh Version: 1.91.0-5 Severity: critical A long time ago (circa 1998 or so) I looked at pam-ssh project and noticied several problems with it. And since it's now in Debian, the same problems applies to Debian too. Here's one. in pam_sm_authenticate() routine, pam_ssh saves

Bug#301204: libpam-ssh: pam-ssh incorrectly re-uses values returned by getpwnam()

2005-03-24 Thread Justin Pryzby
On Thu, Mar 24, 2005 at 03:55:06PM +0300, Michael Tokarev wrote: Package: libpam-ssh Version: 1.91.0-5 Severity: critical A long time ago (circa 1998 or so) I looked at pam-ssh project and noticied several problems with it. And since it's now in Debian, the same problems applies to Debian

Bug#301204: libpam-ssh: pam-ssh incorrectly re-uses values returned by getpwnam()

2005-03-24 Thread Michael Tokarev
Justin Pryzby wrote: On Thu, Mar 24, 2005 at 03:55:06PM +0300, Michael Tokarev wrote: Package: libpam-ssh Version: 1.91.0-5 Severity: critical A long time ago (circa 1998 or so) I looked at pam-ssh project and noticied several problems with it. And since it's now in Debian, the same problems

Bug#301204: libpam-ssh: pam-ssh incorrectly re-uses values returned by getpwnam()

2005-03-24 Thread Michael Tokarev
A small followup with additional comments. Justin Pryzby wrote: [] It seems that your request can be easily satisfied by using the reentrant versions of these functions, like getpwnam_r. I'm including a test file I've been playing with, which indicates that a patch, if necessary, would be