Relevant BUGIDs: 435991

Purpose of commit: bugfix

Commit summary:
---------------
use strncpy, and even then remember to nul terminate. Courtesy of Harald Welte.

diff --git a/CHANGELOG b/CHANGELOG
index e45fc0271286f4e7bfaf31ab5ac6ce4d8809ec23..ee097cdf711b53d5e7f87c41c7e72f4ca6a88de3 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -50,7 +50,8 @@ bug report - outstanding bugs are listed here:
       patches!
 
 * more changes (extracted from redhat version) courtesy of
-  Harald Welte (Bugs pam_limits=436061, pam_lastlog=436060 - agmorgan)
+  Harald Welte (Bugs pam_limits=436061, pam_lastlog=436060,
+  pam_mkhomedir/pam_env=435991 - agmorgan)
 * fix for legacy behavior of pam_setcred and pam_close_session in
   the case that pam_authenticate and pam_open_session hadn't been
   called - bug report from Seongwan Park. (Bug 468724 - agmorgan)

diff --git a/modules/pam_env/pam_env.c b/modules/pam_env/pam_env.c
index f140f3cb49b704a4285e65a95089fb86e6029b85..52e5449068dcc431352aa006d24ac078b41aea08 100644 (file)
--- a/modules/pam_env/pam_env.c
+++ b/modules/pam_env/pam_env.c
@@ -588,7 +588,8 @@ static int _expand_arg(pam_handle_t *pamh, char **value)
          _log_err(LOG_ERR, "Unterminated expandable variable: <%s>", orig-2);
          return PAM_ABORT;
        }
-       strncpy(tmpval, orig, (size_t) BUF_SIZE);
+       strncpy(tmpval, orig, sizeof(tmpval));
+       tmpval[sizeof(tmpval)-1] = '\0';
        orig=ptr;
        /* 
         * so, we know we need to expand tmpval, it is either 

diff --git a/modules/pam_mkhomedir/pam_mkhomedir.c b/modules/pam_mkhomedir/pam_mkhomedir.c
index ec05993dfa1e2be8e11d6326d2392eccd045c95e..ec6bd46d6dfc71b5d5b0f956b01a75762415a7e7 100644 (file)
--- a/modules/pam_mkhomedir/pam_mkhomedir.c
+++ b/modules/pam_mkhomedir/pam_mkhomedir.c
@@ -57,7 +57,7 @@
 #define MKHOMEDIR_QUIET      040       /* keep quiet about things */
 
 static unsigned int UMask = 0022;
-static char SkelDir[BUFSIZ] = "/etc/skel";
+static char SkelDir[BUFSIZ] = "/etc/skel"; /* THIS MODULE IS NOT THREAD SAFE */
 
 /* some syslogging */
 static void _log_err(int err, const char *format, ...)
@@ -82,16 +82,14 @@ static int _pam_parse(int flags, int argc, const char **argv)
    /* step through arguments */
    for (; argc-- > 0; ++argv)
    {
-      if (!strcmp(*argv, "silent"))
-      {
+      if (!strcmp(*argv, "silent")) {
         ctrl |= MKHOMEDIR_QUIET;
-      } 
-      else if (!strncmp(*argv,"umask=",6))
+      } else if (!strncmp(*argv,"umask=",6)) {
         UMask = strtol(*argv+6,0,0);
-      else if (!strncmp(*argv,"skel=",5))
-        strcpy(SkelDir,*argv+5);
-      else
-      {
+      } else if (!strncmp(*argv,"skel=",5)) {
+        strncpy(SkelDir,*argv+5,sizeof(SkelDir));
+        SkelDir[sizeof(SkelDir)-1] = '\0';
+      } else {
         _log_err(LOG_ERR, "unknown option; %s", *argv);
       }
    }