* NEWS, srclib/getlong.c: Fix parsing of octal numbers.

	* NEWS, src/login.c: Fix segfault when no user is provided on the
	command line.

diff --git a/ChangeLog b/ChangeLog
index a8e15f5fd99de47156c5f05879871006c5f3e3cc..0f9824b4ec4c34fb99954554bedde8383f15f095 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2009-04-15  Peter Vrabec <pvrabec@redhat.com>
+
+       * NEWS, srclib/getlong.c: Fix parsing of octal numbers.
+
+2009-04-15  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * NEWS, src/login.c: Fix segfault when no user is provided on the
+       command line.
+
 2009-04-15  Nicolas François  <nicolas.francois@centraliens.net>
 
        * README, libmisc/system.c: Was contributed by Dan Walsh.

diff --git a/NEWS b/NEWS
index 8f96308d01f8c5d7a31db92f946fdbbcf5dd64d6..4067c818c0a0877b938f4f35cc4ffde55c24cffd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,11 +1,19 @@
 $Id$
 
-shadow-4.1.3 -> shadow-4.1.3.1                                         UNRELEASED
+shadow-4.1.3 -> shadow-4.1.3.1                                         2009-04-15
 
+*** security:
+- Due to bad parsing of octal permissions, the permissions on tty (login)
+  but also home directories, mailboxes, or UMASK were set wrongly (and
+  weirdly). Only shadow-4.1.3 was affected.
+
+*** general
 - vipw
   * SE Linux: Set the default context to the context of the file being
     edited. This ensures that the backup file inherit from the file's
     context.
+- login
+  * Fix regression when no user is specified on the command line.
 
 shadow-4.1.2.2 -> shadow-4.1.3                                         2009-04-12
 

diff --git a/lib/getlong.c b/lib/getlong.c
index 7f4c7d7cd5ebcc80e0906b71371616690094a1d1..d1820847dabdc9cbe52ed070b2b8ac608df6c278 100644 (file)
--- a/lib/getlong.c
+++ b/lib/getlong.c
@@ -35,13 +35,20 @@
 #include <errno.h>
 #include "prototypes.h"
 
+/*
+ * getlong - extract a long integer provided by the numstr string in *result
+ *
+ * It supports decimal, hexadecimal or octal representations.
+ *
+ * Returns 0 on failure, 1 on success.
+ */
 int getlong (const char *numstr, long int *result)
 {
        long val;
        char *endptr;
 
        errno = 0;
-       val = strtol (numstr, &endptr, 10);
+       val = strtol (numstr, &endptr, 0);
        if (('\0' == numstr) || ('\0' != *endptr) || (ERANGE == errno)) {
                return 0;
        }

diff --git a/src/login.c b/src/login.c
index 39a0cc80326ebf0a4a5f5b088ff82c4d7098156d..2ba452aa23fcb561b41bfdbc0df62a27f460a128 100644 (file)
--- a/src/login.c
+++ b/src/login.c
@@ -682,7 +682,7 @@ int main (int argc, char **argv)
                   set it to NULL */
                retcode = pam_get_item (pamh, PAM_USER, (const void **)ptr_pam_user);
                PAM_FAIL_CHECK;
-               if (pam_user[0] == '\0') {
+               if ((NULL != pam_user) && ('\0' == pam_user[0])) {
                        retcode = pam_set_item (pamh, PAM_USER, NULL);
                        PAM_FAIL_CHECK;
                }