pam_env: abort when encountering an overflowed environment variable expansion

* modules/pam_env/pam_env.c (_expand_arg): Abort when encountering an
overflowed environment variable expansion.
Fixes CVE-2011-3149.
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874565

diff --git a/ChangeLog b/ChangeLog
index f823d23e9e4de1b7b0a89e6eadbf4a409fb9a12f..107f765135fe4341aac4106ad7f6f9599c108e82 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
 2011-10-14  Kees Cook <kees@debian.org>
 
+       * modules/pam_env/pam_env.c (_expand_arg): Abort when encountering an
+       overflowed environment variable expansion.
+       Fixes CVE-2011-3149.
+       Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874565
+
        * modules/pam_env/pam_env.c (_assemble_line): Correctly count leading
        whitespace.
        Fixes CVE-2011-3148.

diff --git a/modules/pam_env/pam_env.c b/modules/pam_env/pam_env.c
index b7cd387f570debf48e9f1b6b3d12230ddb9fb155..e04f5b53d4ecb15c7b854154a855e64bf7d02ce1 100644 (file)
--- a/modules/pam_env/pam_env.c
+++ b/modules/pam_env/pam_env.c
@@ -570,6 +570,7 @@ static int _expand_arg(pam_handle_t *pamh, char **value)
        D(("Variable buffer overflow: <%s> + <%s>", tmp, tmpptr));
        pam_syslog (pamh, LOG_ERR, "Variable buffer overflow: <%s> + <%s>",
                 tmp, tmpptr);
+       return PAM_BUF_ERR;
       }
       continue;
     }
@@ -631,6 +632,7 @@ static int _expand_arg(pam_handle_t *pamh, char **value)
            D(("Variable buffer overflow: <%s> + <%s>", tmp, tmpptr));
            pam_syslog (pamh, LOG_ERR,
                        "Variable buffer overflow: <%s> + <%s>", tmp, tmpptr);
+           return PAM_BUF_ERR;
          }
        }
       }           /* if ('{' != *orig++) */
@@ -642,6 +644,7 @@ static int _expand_arg(pam_handle_t *pamh, char **value)
        D(("Variable buffer overflow: <%s> + <%s>", tmp, tmpptr));
        pam_syslog(pamh, LOG_ERR,
                   "Variable buffer overflow: <%s> + <%s>", tmp, tmpptr);
+       return PAM_BUF_ERR;
       }
     }
   }              /* for (;*orig;) */