Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package gdm for openSUSE:Factory checked in 
at 2026-08-09 21:31:54
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/gdm (Old)
 and      /work/SRC/openSUSE:Factory/.gdm.new.16738 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "gdm"

Sun Aug  9 21:31:54 2026 rev:303 rq:1369983 version:50.2

Changes:
--------
--- /work/SRC/openSUSE:Factory/gdm/gdm.changes  2026-05-30 22:56:14.731620674 
+0200
+++ /work/SRC/openSUSE:Factory/.gdm.new.16738/gdm.changes       2026-08-09 
21:32:38.376661623 +0200
@@ -1,0 +2,22 @@
+Wed Aug  5 06:30:27 UTC 2026 - Bjørn Lie <[email protected]>
+
+- Update to version 50.2:
+  + Fixed path traversal vulnerability where a compromised greeter
+    could load arbitrary .desktop files via SelectSession,
+    potentially executing attacker-controlled commands as the
+    authenticated user
+  + Fixed autologin bypass where a compromised greeter could
+    request autologin for any local account by sending arbitrary
+    usernames via BeginAutoLogin
+  + Fixed denial of service where an invalid session name from the
+    greeter would cause the entire daemon to exit, terminating all
+    active sessions
+  + Fixed passphrase handling in pam_gdm to wipe cached plaintext
+    passwords before freeing and to bound the keyring buffer walk
+    preventing out-of-bounds reads
+  + Fixed crashes, memory leaks and wrong hash key type in
+    reauthentication channel handler, session worker and dynamic
+    user store
+  + Updated translations.
+
+-------------------------------------------------------------------

Old:
----
  gdm-50.1.tar.xz

New:
----
  gdm-50.2.tar.xz

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ gdm.spec ++++++
--- /var/tmp/diff_new_pack.eFk890/_old  2026-08-09 21:32:39.500700071 +0200
+++ /var/tmp/diff_new_pack.eFk890/_new  2026-08-09 21:32:39.500700071 +0200
@@ -27,7 +27,7 @@
 %endif
 
 Name:           gdm
-Version:        50.1
+Version:        50.2
 Release:        0
 Summary:        The GNOME Display Manager
 License:        GPL-2.0-or-later

++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.eFk890/_old  2026-08-09 21:32:39.560702124 +0200
+++ /var/tmp/diff_new_pack.eFk890/_new  2026-08-09 21:32:39.564702261 +0200
@@ -1,6 +1,6 @@
-mtime: 1780001518
-commit: 9f146b35666555681e582b53d8147b61a4bbc7ab9d0448d0bc08f9624dff11be
+mtime: 1785911541
+commit: e68c6530af58a041bad547ef2ff391026bbb2ae885dfae64f30a63a52878b77d
 url: https://src.opensuse.org/GNOME/gdm
-revision: 9f146b35666555681e582b53d8147b61a4bbc7ab9d0448d0bc08f9624dff11be
+revision: e68c6530af58a041bad547ef2ff391026bbb2ae885dfae64f30a63a52878b77d
 projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj
 

++++++ _service ++++++
--- /var/tmp/diff_new_pack.eFk890/_old  2026-08-09 21:32:39.584702945 +0200
+++ /var/tmp/diff_new_pack.eFk890/_new  2026-08-09 21:32:39.588703082 +0200
@@ -3,7 +3,7 @@
   <service name="obs_scm" mode="manual">
     <param name="scm">git</param>
     <param name="url">https://gitlab.gnome.org/GNOME/gdm.git</param>
-    <param name="revision">50.1</param>
+    <param name="revision">50.2</param>
     <param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param>
     <param name="versionrewrite-pattern">(.*)\+0</param>
     <param name="versionrewrite-replacement">\1</param>

++++++ build.specials.obscpio ++++++

++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore      1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore      2026-08-05 08:32:21.000000000 +0200
@@ -0,0 +1,5 @@
+*.obscpio
+*.osc
+_build.*
+.pbuild
+osc-collab.*

++++++ gdm-50.1.tar.xz -> gdm-50.2.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/NEWS new/gdm-50.2/NEWS
--- old/gdm-50.1/NEWS   2026-05-28 16:22:49.000000000 +0200
+++ new/gdm-50.2/NEWS   2026-08-04 22:14:56.000000000 +0200
@@ -1,3 +1,25 @@
+50.2
+====
+
+* Fixed path traversal vulnerability where a compromised greeter could load
+  arbitrary .desktop files via SelectSession, potentially executing
+  attacker-controlled commands as the authenticated user  [Mario; !377]
+* Fixed autologin bypass where a compromised greeter could request autologin
+  for any local account by sending arbitrary usernames via BeginAutoLogin
+  [Mario; !375]
+* Fixed denial of service where an invalid session name from the greeter would
+  cause the entire daemon to exit, terminating all active sessions  [Mario; 
!376]
+* Fixed passphrase handling in pam_gdm to wipe cached plaintext passwords
+  before freeing and to bound the keyring buffer walk preventing out-of-bounds
+  reads  [Mario; !384]
+* Fixed crashes, memory leaks and wrong hash key type in reauthentication
+  channel handler, session worker and dynamic user store  [Ignacio; !371]
+* Translation updates
+
+Contributors:
+  Christian Kirbach, Ignacio Casal Quinteiro, Mario Limonciello,
+  Victoria Niedzielska
+
 50.1
 ====
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/daemon/gdm-dynamic-user-store.c 
new/gdm-50.2/daemon/gdm-dynamic-user-store.c
--- old/gdm-50.1/daemon/gdm-dynamic-user-store.c        2026-05-28 
16:22:49.000000000 +0200
+++ new/gdm-50.2/daemon/gdm-dynamic-user-store.c        2026-08-04 
22:14:56.000000000 +0200
@@ -620,7 +620,7 @@
         G_MUTEX_AUTO_LOCK (&store->mutex, locker);
 
         if (params.username) {
-                user = g_hash_table_lookup (store->by_name, &params.username);
+                user = g_hash_table_lookup (store->by_name, params.username);
                 if (test_group_membership (user, params.groupname))
                         return reply_user_group (call, VARLINK_REPLY_FINAL, 
user);
         } else {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/daemon/gdm-manager.c 
new/gdm-50.2/daemon/gdm-manager.c
--- old/gdm-50.1/daemon/gdm-manager.c   2026-05-28 16:22:49.000000000 +0200
+++ new/gdm-50.2/daemon/gdm-manager.c   2026-08-04 22:14:56.000000000 +0200
@@ -952,6 +952,12 @@
         close_transient_session (self, session);
 }
 
+static void
+clear_user_session (GdmSession *user_session)
+{
+        g_clear_object (&user_session);
+}
+
 static char *
 open_temporary_reauthentication_channel (GdmManager            *self,
                                          GdmSession            *user_session,
@@ -993,7 +999,7 @@
                                 "user-session",
                                 user_session? g_object_ref (user_session) : 
NULL,
                                 (GDestroyNotify)
-                                g_object_unref);
+                                clear_user_session);
         g_object_set_data (G_OBJECT (session),
                            "caller-pid",
                            GUINT_TO_POINTER (pid));
@@ -1069,13 +1075,13 @@
         GdmSession       *session;
         GdmSession       *login_session = NULL;
         GDBusConnection  *connection;
-        char             *seat_id = NULL;
-        char             *session_id = NULL;
+        g_autofree char  *seat_id = NULL;
+        g_autofree char  *session_id = NULL;
         GPid              pid = 0;
         uid_t             uid = (uid_t) -1;
         gboolean          is_login_screen = FALSE;
         gboolean          is_remote = FALSE;
-        char             *address = NULL;
+        g_autofree char  *address = NULL;
 
         g_debug ("GdmManager: trying to open reauthentication channel for user 
%s", username);
 
@@ -1139,7 +1145,6 @@
         gdm_dbus_manager_complete_open_reauthentication_channel 
(GDM_DBUS_MANAGER (manager),
                                                                  invocation,
                                                                  address);
-        g_free (address);
         return TRUE;
 }
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/daemon/gdm-session-worker.c 
new/gdm-50.2/daemon/gdm-session-worker.c
--- old/gdm-50.1/daemon/gdm-session-worker.c    2026-05-28 16:22:49.000000000 
+0200
+++ new/gdm-50.2/daemon/gdm-session-worker.c    2026-08-04 22:14:56.000000000 
+0200
@@ -2859,7 +2859,9 @@
                 if (g_strcmp0 (key, "service") == 0) {
                         worker->service = g_variant_dup_string (value, NULL);
                 } else if (g_strcmp0 (key, "extensions") == 0) {
-                        worker->extensions = filter_extensions 
(g_variant_get_strv (value, NULL));
+                        g_autofree const char **supported_extensions = 
g_variant_get_strv (value, NULL);
+
+                        worker->extensions = filter_extensions 
(supported_extensions);
                 } else if (g_strcmp0 (key, "username") == 0) {
                         worker->username = g_variant_dup_string (value, NULL);
                 } else if (g_strcmp0 (key, "is-program-session") == 0) {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/daemon/gdm-session.c 
new/gdm-50.2/daemon/gdm-session.c
--- old/gdm-50.1/daemon/gdm-session.c   2026-05-28 16:22:49.000000000 +0200
+++ new/gdm-50.2/daemon/gdm-session.c   2026-08-04 22:14:56.000000000 +0200
@@ -441,6 +441,13 @@
         gboolean    res;
         char      **search_dirs;
 
+        g_return_val_if_fail (file != NULL, NULL);
+
+        if (strchr (file, '/') != NULL) {
+                g_warning ("GdmSession: rejecting session file with path 
separator: %s", file);
+                return NULL;
+        }
+
         key_file = g_key_file_new ();
 
         search_dirs = get_system_session_dirs (self, type);
@@ -1808,6 +1815,8 @@
                                             GdmSession            *self)
 {
         const char *session_username;
+        g_autofree char *allowed = NULL;
+        gboolean enabled = FALSE;
 
         if (gdm_session_is_running (self)) {
                 session_username = gdm_session_get_username (self);
@@ -1823,6 +1832,19 @@
                 return TRUE;
         }
 
+        gdm_settings_direct_get_boolean (GDM_KEY_AUTO_LOGIN_ENABLE, &enabled);
+        gdm_settings_direct_get_string (GDM_KEY_AUTO_LOGIN_USER, &allowed);
+        if (!enabled || allowed == NULL || g_strcmp0 (allowed, username) != 0) 
{
+                g_debug ("GdmSession: refusing auto login for user '%s' 
(enabled=%d, allowed=%s)",
+                         username, enabled, allowed ? allowed : "(null)");
+                g_dbus_method_invocation_return_error (invocation,
+                                                       G_DBUS_ERROR,
+                                                       
G_DBUS_ERROR_ACCESS_DENIED,
+                                                       "Autologin not 
permitted for user %s",
+                                                       username);
+                return TRUE;
+        }
+
         if (self->greeter_interface != NULL) {
                 gdm_dbus_greeter_complete_begin_auto_login (greeter_interface,
                                                             invocation);
@@ -2744,7 +2766,8 @@
 }
 
 static char *
-get_session_command (GdmSession *self)
+get_session_command (GdmSession  *self,
+                     GError     **error)
 {
         gboolean    res;
         char       *command;
@@ -2755,8 +2778,12 @@
         command = NULL;
         res = get_session_command_for_name (self, session_name, NULL, 
&command);
         if (! res) {
-                g_critical ("Cannot find a command for specified session: %s", 
session_name);
-                exit (EXIT_FAILURE);
+                g_set_error (error,
+                             G_IO_ERROR,
+                             G_IO_ERROR_NOT_FOUND,
+                             "Cannot find a command for specified session: %s",
+                             session_name);
+                return NULL;
         }
 
         return command;
@@ -3025,6 +3052,7 @@
         GdmSessionConversation *conversation;
         g_autofree char        *command = NULL;
         g_autofree char        *program = NULL;
+        g_autoptr(GError)       error = NULL;
 
         g_return_if_fail (GDM_IS_SESSION (self));
         g_return_if_fail (service_name != NULL);
@@ -3040,7 +3068,16 @@
 
         stop_all_other_conversations (self, conversation, FALSE);
 
-        command = get_session_command (self);
+        command = get_session_command (self, &error);
+
+        if (command == NULL) {
+                gdm_session_stop_conversation (self, service_name);
+
+                g_debug ("GdmSession: Emitting 'session-start-failed' signal");
+                g_signal_emit (self, signals[SESSION_START_FAILED], 0, 
service_name,
+                               error->message);
+                return;
+        }
 
         if (g_strcmp0 (self->session_type, "wayland") == 0) {
                 gboolean needs_registration = !gdm_session_session_registers 
(self);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/docs/de/de.po new/gdm-50.2/docs/de/de.po
--- old/gdm-50.1/docs/de/de.po  2026-05-28 16:22:49.000000000 +0200
+++ new/gdm-50.2/docs/de/de.po  2026-08-04 22:14:56.000000000 +0200
@@ -17,8 +17,8 @@
 msgstr ""
 "Project-Id-Version: gdm master\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-08-12 20:50+0000\n"
-"PO-Revision-Date: 2025-08-16 22:04+0200\n"
+"POT-Creation-Date: 2026-07-10 13:07+0000\n"
+"PO-Revision-Date: 2026-07-31 23:05+0200\n"
 "Last-Translator: Christian Kirbach <[email protected]>\n"
 "Language-Team: Deutsch <[email protected]>\n"
 "Language: de\n"
@@ -26,7 +26,7 @@
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=(n!=1);\n"
-"X-Generator: Poedit 3.6\n"
+"X-Generator: Poedit 3.9\n"
 
 # Den Punkt hinter der Jahreszahl bitte weglassen, das sieht später im Layout 
doof aus.
 #. Put one translator per line, in the form NAME <EMAIL>, YEAR1, YEAR2
@@ -34,7 +34,7 @@
 msgid "translator-credits"
 msgstr ""
 "Mario Blättermann <[email protected]>, 2008, 2010-2012\n"
-"Christian Kirbach <[email protected]>, 2009, 2013, 
2015,2024,2025\n"
+"Christian Kirbach <[email protected]>, 2009, 2013, 
2015,2024,2025,2026\n"
 "Benjamin Steinwender <[email protected]>, 2014\n"
 "Jürgen Benvenuti <[email protected]>, 2024\n"
 "Philipp Kiemle <[email protected]>, 2024"
@@ -132,10 +132,10 @@
 #: C/index.docbook:107
 msgid ""
 "FreeDesktop - The organization providing desktop standards, such as the 
Desktop Entry Specification used by GDM. <ulink type=\"http\" "
-"url=\"http://www.freedesktop.org/\";> http://www.freedesktop.org</ulink>."
+"url=\"https://www.freedesktop.org/\";> https://www.freedesktop.org</ulink>."
 msgstr ""
-"FreeDesktop - Die Organisation, die Desktop-Standards bereitstellt, wie die 
Spezifikation der Desktop-Einträge, die von GDM verwendet "
-"werden. <ulink type=\"http\" url=\"http://www.freedesktop.org/\";> 
http://www.freedesktop.org</ulink>."
+"FreeDesktop - Die Organisation, die Desktop-Standards bereitstellt, wie 
beispielsweise die Spezifikation der Desktop-Einträge, die von GDM "
+"verwendet werden. <ulink type=\"http\" url=\"https://www.freedesktop.org/\";> 
http://www.freedesktop.org</ulink>."
 
 #. (itstool) path: sect1/para
 #: C/index.docbook:113
@@ -161,10 +161,10 @@
 #: C/index.docbook:130
 msgid ""
 "Xserver - An implementation of the X Window System. For example the Xorg 
Xserver provided by the X.org Foundation <ulink type=\"http\" "
-"url=\"http://www.x.org/\";>http://www.x.org</ulink>."
+"url=\"https://www.x.org/\";>https://www.x.org</ulink>."
 msgstr ""
 "Xserver - Eine Implementierung des »X Window System«. Beispielsweise der Xorg 
Xserver, der durch die »X.org Foundation« (<ulink "
-"type=\"http\" url=\"http://www.x.org/\";>http://www.x.org</ulink>) bereit 
gestellt wird."
+"type=\"http\" url=\"https://www.x.org/\";>http://www.x.org</ulink>) bereit 
gestellt wird."
 
 #. (itstool) path: sect1/para
 #: C/index.docbook:136
@@ -217,11 +217,9 @@
 #. (itstool) path: sect2/para
 #: C/index.docbook:172
 msgid ""
-"For further information about GDM, refer to the project website at <ulink 
type=\"http\" url=\"http://wiki.gnome.org/Projects/GDM/\";> "
-"http://wiki.gnome.org/Projects/GDM</ulink>."
+"For further information about GDM, refer to the <ulink type=\"http\" 
url=\"https://gitlab.gnome.org/GNOME/gdm\";>project website</ulink>."
 msgstr ""
-"Weitere Informationen über GDM finden Sie auf der Projekt-Website: <ulink 
type=\"http\" url=\"http://wiki.gnome.org/Projects/GDM/\";>http://";
-"wiki.gnome.org/Projects/GDM</ulink>."
+"Weitere Informationen über GDM finden Sie auf der <ulink type=\"http\" 
url=\"https://gitlab.gnome.org/GNOME/gdm\";>Projekt-Webseite</ulink>."
 
 #. (itstool) path: sect2/para
 #: C/index.docbook:178
@@ -2467,11 +2465,11 @@
 #: C/index.docbook:1897
 msgid ""
 "GDM sessions are specified using the FreeDesktop.org Desktop Entry 
Specification, which can be referenced at the following URL: <ulink "
-"url=\"http://www.freedesktop.org/wiki/Specifications/desktop-entry-spec\";> 
http://www.freedesktop.org/wiki/Specifications/desktop-entry-";
+"url=\"https://www.freedesktop.org/wiki/Specifications/desktop-entry-spec/\";> 
https://www.freedesktop.org/wiki/Specifications/desktop-entry-";
 "spec</ulink>."
 msgstr ""
 "GDM-Sitzungen werden durch die Spezifikation zum FreeDesktop.org 
Desktop-Eintrag angegeben, welche unter der folgenden Adresse abgerufen "
-"werden kann: <ulink 
url=\"http://www.freedesktop.org/wiki/Specifications/desktop-entry-spec\";> 
http://www.freedesktop.org/wiki/";
+"werden kann: <ulink 
url=\"https://www.freedesktop.org/wiki/Specifications/desktop-entry-spec\";> 
https://www.freedesktop.org/wiki/";
 "Specifications/desktop-entry-spec</ulink>."
 
 #. (itstool) path: sect2/para
@@ -2796,12 +2794,11 @@
 msgid ""
 "A copy of the <citetitle>GNU General Public License</citetitle> is included 
as an appendix to the <citetitle>GNOME Users Guide</"
 "citetitle>. You may also obtain a copy of the <citetitle>GNU General Public 
License</citetitle> from the Free Software Foundation by "
-"visiting <ulink type=\"http\" url=\"http://www.fsf.org\";>their Web 
site</ulink> or by writing to <_:address-1/>"
+"visiting <ulink type=\"http\" url=\"https://www.fsf.org/\";>their Web 
site</ulink> or by writing to <_:address-1/>"
 msgstr ""
 "Eine Kopie der <citetitle>GNU General Public License</citetitle> ist im 
Anhang des <citetitle>GNOME Benutzerhandbuchs</citetitle> "
-"enthalten. Sie können außerdem eine Kopie der <citetitle><ulink type=\"help\" 
url=\"gnome-help:gpl\">GNU General Public License</ulink></"
-"citetitle> von der Free Software Foundation erhalten, indem Sie auf <ulink 
type=\"http\" url=\"http://www.fsf.org\";>ihre Internetseite</"
-"ulink> gehen oder schreiben Sie an die <_:address-1/>"
+"enthalten. Sie können außerdem eine Kopie der <citetitle>GNU General Public 
License</citetitle> von der Free Software Foundation erhalten, "
+"indem Sie auf <ulink type=\"http\" url=\"https://www.fsf.org\";>ihre 
Internetseite</ulink> gehen oder schreiben Sie an die <_:address-1/>"
 
 #. (itstool) path: para/ulink
 #: C/legal.xml:9
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/meson.build new/gdm-50.2/meson.build
--- old/gdm-50.1/meson.build    2026-05-28 16:22:49.000000000 +0200
+++ new/gdm-50.2/meson.build    2026-08-04 22:14:56.000000000 +0200
@@ -1,5 +1,5 @@
 project('gdm', 'c',
-  version: '50.1',
+  version: '50.2',
   license: 'GPL2+',
   meson_version: '>= 0.57',
 )
@@ -220,6 +220,7 @@
 conf.set('HAVE_LOGOUT', cc.has_function('logout', args: '-lutil'))
 conf.set('HAVE_LOGWTMP', cc.has_function('logwtmp', args: '-lutil'))
 conf.set('HAVE_PAM_SYSLOG', have_pam_syslog)
+conf.set('HAVE_EXPLICIT_BZERO', cc.has_function('explicit_bzero'))
 conf.set('HAVE_KEYUTILS', keyutils_dep.found())
 conf.set('SUPPORTS_PAM_EXTENSIONS', pam_extensions_supported)
 conf.set('HAVE_SELINUX', libselinux_dep.found())
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/pam_gdm/pam_gdm.c 
new/gdm-50.2/pam_gdm/pam_gdm.c
--- old/gdm-50.1/pam_gdm/pam_gdm.c      2026-05-28 16:22:49.000000000 +0200
+++ new/gdm-50.2/pam_gdm/pam_gdm.c      2026-08-04 22:14:56.000000000 +0200
@@ -19,6 +19,7 @@
  */
 #include <config.h>
 
+#include <string.h>
 #include <unistd.h>
 
 #include <security/_pam_macros.h>
@@ -31,6 +32,18 @@
 #include <keyutils.h>
 #endif
 
+static inline void
+gdm_pam_zero_buffer (void   *s,
+                     size_t  n)
+{
+#ifdef HAVE_EXPLICIT_BZERO
+        explicit_bzero (s, n);
+#else
+        memset (s, 0, n);
+        __asm__ __volatile__ ("" : : "r"(s) : "memory");
+#endif
+}
+
 int
 pam_sm_authenticate (pam_handle_t  *pamh,
                      int            flags,
@@ -52,10 +65,23 @@
         r = keyctl_read_alloc (serial, &cached_passwords);
         if (r < 0)
                 return PAM_AUTHINFO_UNAVAIL;
-        
+
         cached_passwords_length = r;
 
         /*
+            The payload is a NUL-separated list of passwords, but the blob
+            returned by the kernel is not guaranteed to be NUL-terminated.
+            Reject a payload whose final entry is not terminated within the
+            buffer so that walking it below cannot read past the end.
+        */
+        if (cached_passwords_length == 0 ||
+            ((char *) cached_passwords)[cached_passwords_length - 1] != '\0') {
+                gdm_pam_zero_buffer (cached_passwords, 
cached_passwords_length);
+                free (cached_passwords);
+                return PAM_AUTHINFO_UNAVAIL;
+        }
+
+        /*
             Find the last password in the NUL-separated list of passwords.
             Multiple passwords are returned either when the user enters an
             incorrect password or there are multiple encrypted drives.
@@ -66,12 +92,15 @@
         */
         last_cached_password = cached_passwords;
         for (i = 0; i < cached_passwords_length; i++) {
+                size_t remaining = cached_passwords_length - i;
                 last_cached_password = ((char *) cached_passwords) + i;
-                i += strlen (last_cached_password);
+                i += strnlen (last_cached_password, remaining);
         }
 
         r = pam_set_item (pamh, PAM_AUTHTOK, last_cached_password);
 
+        /* pam_set_item copies the string, so the plaintext can now be wiped. 
*/
+        gdm_pam_zero_buffer (cached_passwords, cached_passwords_length);
         free (cached_passwords);
 
         if (r < 0)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/gdm-50.1/po/pl.po new/gdm-50.2/po/pl.po
--- old/gdm-50.1/po/pl.po       2026-05-28 16:22:49.000000000 +0200
+++ new/gdm-50.2/po/pl.po       2026-08-04 22:14:56.000000000 +0200
@@ -15,7 +15,7 @@
 msgstr ""
 "Project-Id-Version: gdm\n"
 "Report-Msgid-Bugs-To: https://gitlab.gnome.org/GNOME/gdm/issues/\n";
-"POT-Creation-Date: 2026-02-18 11:06+0000\n"
+"POT-Creation-Date: 2026-05-28 14:15+0000\n"
 "PO-Revision-Date: 2026-03-27 11:23+0100\n"
 "Last-Translator: Victoria Niedzielska <[email protected]>\n"
 "Language-Team: Polish <https://l10n.gnome.org/teams/pl/>\n"
@@ -43,33 +43,33 @@
 msgid "Could not identify the current seat."
 msgstr "Nie można zidentyfikować bieżącego stanowiska."
 
-#: daemon/gdm-manager.c:668 daemon/gdm-manager.c:704
+#: daemon/gdm-manager.c:682 daemon/gdm-manager.c:718
 msgid "No display available"
 msgstr "Brak dostępnych ekranów"
 
-#: daemon/gdm-manager.c:754 daemon/gdm-manager.c:1059
+#: daemon/gdm-manager.c:785 daemon/gdm-manager.c:1090
 msgid "No session available"
 msgstr "Brak dostępnych sesji"
 
-#: daemon/gdm-manager.c:770
+#: daemon/gdm-manager.c:801
 msgid "Can only be called before user is logged in"
-msgstr "Może być wywoływane tylko przed zalogowaniem osoby"
+msgstr "Może być wywoływane tylko przed zalogowaniem użytkownika"
 
-#: daemon/gdm-manager.c:782
+#: daemon/gdm-manager.c:813
 msgid "Caller not GDM"
 msgstr "Program wywołujący to nie GDM"
 
-#: daemon/gdm-manager.c:792
+#: daemon/gdm-manager.c:823
 msgid "Unable to open private communication channel"
 msgstr "Nie można otworzyć prywatnego kanału komunikacji"
 
 #: daemon/gdm-session-auditor.c:88
 msgid "Username"
-msgstr "Nazwa osoby"
+msgstr "Nazwa użytkownika"
 
 #: daemon/gdm-session-auditor.c:89
 msgid "The username"
-msgstr "Nazwa osoby"
+msgstr "Nazwa użytkownika"
 
 #: daemon/gdm-session-auditor.c:93
 msgid "Hostname"
@@ -87,7 +87,7 @@
 msgid "The display device"
 msgstr "Urządzenie wyświetlające"
 
-#: daemon/gdm-session.c:1442
+#: daemon/gdm-session.c:1446
 msgid "Could not create authentication helper process"
 msgstr "Nie można utworzyć pomocniczego procesu uwierzytelniania"
 
@@ -158,15 +158,15 @@
 
 #: daemon/gdm-session-worker.c:1208
 msgid "Username:"
-msgstr "Nazwa osoby:"
+msgstr "Nazwa użytkownika:"
 
-#: daemon/gdm-session-worker.c:1625 daemon/gdm-session-worker.c:1642
+#: daemon/gdm-session-worker.c:1628 daemon/gdm-session-worker.c:1645
 msgid "no user account available"
-msgstr "brak dostępnego konta osoby"
+msgstr "brak dostępnego konta użytkownika"
 
-#: daemon/gdm-session-worker.c:1669
+#: daemon/gdm-session-worker.c:1672
 msgid "Unable to change to user"
-msgstr "Nie można zmienić osoby"
+msgstr "Nie można zmienić użytkownika"
 
 #: daemon/gdm-wayland-session.c:513
 msgid "GNOME Display Manager Wayland Session Launcher"
@@ -197,7 +197,7 @@
 #. make sure the pid file doesn't get wiped
 #: daemon/main.c:255
 msgid "Only the root user can run GDM"
-msgstr "Tylko osoba root może uruchamiać GDM"
+msgstr "Tylko użytkownik root może uruchamiać GDM"
 
 #. Translators: worker is a helper process that does the work
 #. of starting up a session
@@ -223,11 +223,12 @@
 
 #: data/org.gnome.displaymanager.policy:11
 msgid "Allow managing user sessions"
-msgstr "Pozwalaj na zarządzanie sesjami osób"
+msgstr "Pozwalaj na zarządzanie sesjami użytkowników"
 
 #: data/org.gnome.displaymanager.policy:12
 msgid "Authentication is required to start or stop a user session"
-msgstr "Wymagane jest uwierzytelnienie, aby zacząć lub zatrzymać sesję osoby"
+msgstr ""
+"Wymagane jest uwierzytelnienie, aby zacząć lub zatrzymać sesję użytkownika"
 
 #: data/org.gnome.login-screen.gschema.xml:11
 msgid "Whether or not to allow switchable authentication for login"
@@ -252,7 +253,7 @@
 msgid ""
 "The login screen can optionally allow users to authenticate via web login."
 msgstr ""
-"Ekran logowania może opcjonalnie umożliwiać osobom uwierzytelnianie za "
+"Ekran logowania może opcjonalnie umożliwiać użytkownikom uwierzytelnianie za "
 "pomocą logowania internetowego"
 
 #: data/org.gnome.login-screen.gschema.xml:31
@@ -264,8 +265,8 @@
 "The login screen can optionally allow users who have passkeys to log in "
 "using those passkeys."
 msgstr ""
-"Ekran logowania może opcjonalnie umożliwiać osobom mającym klucze logowanie "
-"za ich pomocą."
+"Ekran logowania może opcjonalnie umożliwiać użytkownikom mającym klucze "
+"logowanie za ich pomocą."
 
 #: data/org.gnome.login-screen.gschema.xml:41
 msgid "Whether or not to allow fingerprint readers for login"
@@ -276,8 +277,8 @@
 "The login screen can optionally allow users who have enrolled their "
 "fingerprints to log in using those prints."
 msgstr ""
-"Ekran logowania może opcjonalnie umożliwiać osobom, które zarejestrowały "
-"swoje odciski palców logowanie za ich pomocą."
+"Ekran logowania może opcjonalnie umożliwiać użytkownikom, którzy "
+"zarejestrowali swoje odciski palców logowanie za ich pomocą."
 
 #: data/org.gnome.login-screen.gschema.xml:51
 msgid "Whether or not to allow smartcard readers for login"
@@ -288,8 +289,8 @@
 "The login screen can optionally allow users who have smartcards to log in "
 "using those smartcards."
 msgstr ""
-"Ekran logowania może opcjonalnie umożliwiać osobom mającym karty smartcard "
-"logowanie za ich pomocą."
+"Ekran logowania może opcjonalnie umożliwiać użytkownikom mającym karty "
+"smartcard logowanie za ich pomocą."
 
 #: data/org.gnome.login-screen.gschema.xml:61
 msgid "Whether or not to allow passwords for login"
@@ -307,35 +308,35 @@
 #: data/org.gnome.login-screen.gschema.xml:71
 #: data/org.gnome.login-screen.gschema.xml:81
 msgid "Path to small image at top of user list"
-msgstr "Ścieżka do małego obrazu na górze listy osób"
+msgstr "Ścieżka do małego obrazu na górze listy użytkowników"
 
 #: data/org.gnome.login-screen.gschema.xml:74
 msgid ""
 "The login screen can optionally show a small image to provide site "
 "administrators and distributions a way to display branding."
 msgstr ""
-"Ekran logowania może opcjonalnie wyświetlać mały obraz, aby osoby "
-"administrujące i dystrybucje mogły wyświetlać swoje marki."
+"Ekran logowania może opcjonalnie wyświetlać mały obraz, aby administratorzy "
+"i dystrybucje mogły wyświetlać swoje marki."
 
 #: data/org.gnome.login-screen.gschema.xml:84
 msgid ""
 "The fallback login screen can optionally show a small image to provide site "
 "administrators and distributions a way to display branding."
 msgstr ""
-"Zastępczy ekran logowania może opcjonalnie wyświetlać mały obraz, aby osoby "
-"administrujące i dystrybucje mogły wyświetlać swoje marki."
+"Zastępczy ekran logowania może opcjonalnie wyświetlać mały obraz, aby "
+"administratorzy i dystrybucje mogły wyświetlać swoje marki."
 
 #: data/org.gnome.login-screen.gschema.xml:91
 msgid "Avoid showing user list"
-msgstr "Bez wyświetlania listy osób"
+msgstr "Bez wyświetlania listy użytkowników"
 
 #: data/org.gnome.login-screen.gschema.xml:94
 msgid ""
 "The login screen normally shows a list of available users to log in as. This "
 "setting can be toggled to disable showing the user list."
 msgstr ""
-"Ekran logowania zwykle wyświetla listę dostępnych osób. To ustawienie może "
-"być przełączone, aby wyłączyć jej wyświetlanie."
+"Ekran logowania zwykle wyświetla listę dostępnych użytkowników. To "
+"ustawienie może być używane, aby wyłączyć jej wyświetlanie."
 
 #: data/org.gnome.login-screen.gschema.xml:101
 msgid "Enable showing the banner message"
@@ -390,8 +391,8 @@
 "The number of times a user is allowed to attempt authentication, before "
 "giving up and going back to user selection."
 msgstr ""
-"Określa, ile razy osoba może próbować się uwierzytelnić przed powrotem do "
-"ekranu wyboru osoby."
+"Określa, ile razy użytkownik może próbować się uwierzytelnić przed powrotem "
+"do ekranu wyboru użytkownika."
 
 #: utils/gdm-config.c:117
 msgid "Show command help"
@@ -611,7 +612,7 @@
 #: utils/gdm-config.c:1616
 #, c-format
 msgid "You need to be root to use %s “%s” command"
-msgstr "Tylko root może używać polecenia %s „%s”"
+msgstr "Tylko użytkownik root może używać polecenia %s „%s”"
 
 #: utils/gdm-config.c:1666
 #, c-format
@@ -686,7 +687,7 @@
 
 #: utils/gdm-config.c:1908
 msgid "User cancelled the request"
-msgstr "osoba anulowała żądanie"
+msgstr "Użytkownik anulował żądanie"
 
 #: utils/gdm-config.c:1939
 #, c-format

++++++ gdm.obsinfo ++++++
--- /var/tmp/diff_new_pack.eFk890/_old  2026-08-09 21:32:40.308727711 +0200
+++ /var/tmp/diff_new_pack.eFk890/_new  2026-08-09 21:32:40.312727847 +0200
@@ -1,5 +1,5 @@
 name: gdm
-version: 50.1
-mtime: 1779978169
-commit: 31ab23d8f0cbfb350a4ed4d8cfaab4716e38f963
+version: 50.2
+mtime: 1785874496
+commit: 8c0dac188fd1af73f73d2eac902cc9fbdd65a038
 

Reply via email to