diff options
author | Damien Miller <djm@mindrot.org> | 2006-03-26 14:22:47 +1100 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2006-03-26 14:22:47 +1100 |
commit | 36812092ecb11a25ca9d6d87fdeaf53e371c5043 (patch) | |
tree | 257ccc18998146f7f6e6c25cbb0ff9bd6de946a5 /auth-pam.c | |
parent | 07d86bec5eeaf19fe33dca99c8ebcbe9a77c3938 (diff) |
- djm@cvs.openbsd.org 2006/03/25 01:13:23
[buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
[sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
[uidswap.c]
change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
to xrealloc(p, new_nmemb, new_itemsize).
realloc is particularly prone to integer overflows because it is
almost always allocating "n * size" bytes, so this is a far safer
API; ok deraadt@
Diffstat (limited to 'auth-pam.c')
-rw-r--r-- | auth-pam.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/auth-pam.c b/auth-pam.c index 3d64de76a..c12f413e7 100644 --- a/auth-pam.c +++ b/auth-pam.c | |||
@@ -703,7 +703,7 @@ sshpam_query(void *ctx, char **name, char **info, | |||
703 | case PAM_PROMPT_ECHO_OFF: | 703 | case PAM_PROMPT_ECHO_OFF: |
704 | *num = 1; | 704 | *num = 1; |
705 | len = plen + mlen + 1; | 705 | len = plen + mlen + 1; |
706 | **prompts = xrealloc(**prompts, len); | 706 | **prompts = xrealloc(**prompts, 1, len); |
707 | strlcpy(**prompts + plen, msg, len - plen); | 707 | strlcpy(**prompts + plen, msg, len - plen); |
708 | plen += mlen; | 708 | plen += mlen; |
709 | **echo_on = (type == PAM_PROMPT_ECHO_ON); | 709 | **echo_on = (type == PAM_PROMPT_ECHO_ON); |
@@ -713,7 +713,7 @@ sshpam_query(void *ctx, char **name, char **info, | |||
713 | case PAM_TEXT_INFO: | 713 | case PAM_TEXT_INFO: |
714 | /* accumulate messages */ | 714 | /* accumulate messages */ |
715 | len = plen + mlen + 2; | 715 | len = plen + mlen + 2; |
716 | **prompts = xrealloc(**prompts, len); | 716 | **prompts = xrealloc(**prompts, 1, len); |
717 | strlcpy(**prompts + plen, msg, len - plen); | 717 | strlcpy(**prompts + plen, msg, len - plen); |
718 | plen += mlen; | 718 | plen += mlen; |
719 | strlcat(**prompts + plen, "\n", len - plen); | 719 | strlcat(**prompts + plen, "\n", len - plen); |