Only set std_prompt for the PAM_PROMPT_* cases. The conversation function

may be called for non-password reading purposes so we must be careful
not to use def_prompt in cases where it may not be set.

diff --git a/auth/pam.c b/auth/pam.c
index b539b1ff25a9c1fc7081e62079b3a4da56f12d30..8ab2319614cdee34ac250e242c76102bf3a9c085 100644 (file)
--- a/auth/pam.c
+++ b/auth/pam.c
@@ -257,11 +257,6 @@ sudo_conv(num_msg, msg, response, appdata_ptr)
        return(PAM_CONV_ERR);
     zero_bytes(*response, num_msg * sizeof(struct pam_response));
 
-    /* Is the sudo prompt standard? (If so, we'l just use PAM's) */
-    std_prompt =  strncmp(def_prompt, "Password:", 9) == 0 &&
-       (def_prompt[9] == '\0' ||
-       (def_prompt[9] == ' ' && def_prompt[10] == '\0'));
-
     for (pr = *response, pm = *msg, n = num_msg; n--; pr++, pm++) {
        flags = tgetpass_flags;
        switch (pm->msg_style) {
@@ -269,6 +264,12 @@ sudo_conv(num_msg, msg, response, appdata_ptr)
                SET(flags, TGP_ECHO);
            case PAM_PROMPT_ECHO_OFF:
                prompt = def_prompt;
+
+               /* Is the sudo prompt standard? (If so, we'l just use PAM's) */
+               std_prompt =  strncmp(def_prompt, "Password:", 9) == 0 &&
+                   (def_prompt[9] == '\0' ||
+                   (def_prompt[9] == ' ' && def_prompt[10] == '\0'));
+
                /* Only override PAM prompt if it matches /^Password: ?/ */
 #if defined(PAM_TEXT_DOMAIN) && defined(HAVE_DGETTEXT)
                if (!def_passprompt_override && (std_prompt ||