From ca7c435740d2c0c23a34394f50274f08bfcd349d Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Sat, 19 Mar 2005 03:08:40 +0000 Subject: [PATCH] Zero old pw_passwd before replacing with version from shadow file. --- pwutil.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/pwutil.c b/pwutil.c index e6d53a8a4..6604081de 100644 --- a/pwutil.c +++ b/pwutil.c @@ -215,6 +215,7 @@ sudo_getpwuid(uid) { struct passwd key, *pw; struct rbnode *node; + char *cp; key.pw_uid = uid; if ((node = rbfind(pwcache_byuid, &key)) != NULL) { @@ -226,7 +227,11 @@ sudo_getpwuid(uid) */ if ((pw = getpwuid(uid)) != NULL) { pw = sudo_pwdup(pw); - pw->pw_passwd = sudo_getepw(pw); /* get shadow password */ + cp = sudo_getepw(pw); /* get shadow password */ + if (pw->pw_passwd != NULL) + zero_bytes(pw->pw_passwd, strlen(pw->pw_passwd)); + pw->pw_passwd = cp; + if (rbinsert(pwcache_byname, (VOID *) pw) != NULL) errorx(1, "unable to cache user name, already exists"); if (rbinsert(pwcache_byuid, (VOID *) pw) != NULL) @@ -265,7 +270,11 @@ sudo_getpwnam(name) */ if ((pw = getpwnam(name)) != NULL) { pw = sudo_pwdup(pw); - pw->pw_passwd = sudo_getepw(pw); /* get shadow password */ + cp = sudo_getepw(pw); /* get shadow password */ + if (pw->pw_passwd != NULL) + zero_bytes(pw->pw_passwd, strlen(pw->pw_passwd)); + pw->pw_passwd = cp; + if (rbinsert(pwcache_byname, (VOID *) pw) != NULL) errorx(1, "unable to cache user name, already exists"); if (rbinsert(pwcache_byuid, (VOID *) pw) != NULL) -- 2.50.1