summaryrefslogtreecommitdiff
path: root/auth-pam.c
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2006-03-26 14:22:47 +1100
committerDamien Miller <djm@mindrot.org>2006-03-26 14:22:47 +1100
commit36812092ecb11a25ca9d6d87fdeaf53e371c5043 (patch)
tree257ccc18998146f7f6e6c25cbb0ff9bd6de946a5 /auth-pam.c
parent07d86bec5eeaf19fe33dca99c8ebcbe9a77c3938 (diff)
- djm@cvs.openbsd.org 2006/03/25 01:13:23
[buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c] [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c] [uidswap.c] change OpenSSH's xrealloc() function from being xrealloc(p, new_size) to xrealloc(p, new_nmemb, new_itemsize). realloc is particularly prone to integer overflows because it is almost always allocating "n * size" bytes, so this is a far safer API; ok deraadt@
Diffstat (limited to 'auth-pam.c')
-rw-r--r--auth-pam.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/auth-pam.c b/auth-pam.c
index 3d64de76a..c12f413e7 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -703,7 +703,7 @@ sshpam_query(void *ctx, char **name, char **info,
703 case PAM_PROMPT_ECHO_OFF: 703 case PAM_PROMPT_ECHO_OFF:
704 *num = 1; 704 *num = 1;
705 len = plen + mlen + 1; 705 len = plen + mlen + 1;
706 **prompts = xrealloc(**prompts, len); 706 **prompts = xrealloc(**prompts, 1, len);
707 strlcpy(**prompts + plen, msg, len - plen); 707 strlcpy(**prompts + plen, msg, len - plen);
708 plen += mlen; 708 plen += mlen;
709 **echo_on = (type == PAM_PROMPT_ECHO_ON); 709 **echo_on = (type == PAM_PROMPT_ECHO_ON);
@@ -713,7 +713,7 @@ sshpam_query(void *ctx, char **name, char **info,
713 case PAM_TEXT_INFO: 713 case PAM_TEXT_INFO:
714 /* accumulate messages */ 714 /* accumulate messages */
715 len = plen + mlen + 2; 715 len = plen + mlen + 2;
716 **prompts = xrealloc(**prompts, len); 716 **prompts = xrealloc(**prompts, 1, len);
717 strlcpy(**prompts + plen, msg, len - plen); 717 strlcpy(**prompts + plen, msg, len - plen);
718 plen += mlen; 718 plen += mlen;
719 strlcat(**prompts + plen, "\n", len - plen); 719 strlcat(**prompts + plen, "\n", len - plen);