- dtucker@cvs.openbsd.org 2003/12/31 00:24:50

     [auth2-passwd.c]
     Ignore password change request during password auth (which we currently
     don't support) and discard proposed new password.  corrections/ok markus@

1 files changed, 14 insertions, 6 deletions

diff --git a/auth2-passwd.c b/auth2-passwd.c
index 67fb4c921..a4f482d2e 100644
--- a/auth2-passwd.c
+++ b/auth2-passwd.c
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth2-passwd.c,v 1.4 2003/08/26 09:58:43 markus Exp $");
+RCSID("$OpenBSD: auth2-passwd.c,v 1.5 2003/12/31 00:24:50 dtucker Exp $");
 
 #include "xmalloc.h"
 #include "packet.h"
@@ -38,16 +38,24 @@ extern ServerOptions options;
 static int
 userauth_passwd(Authctxt *authctxt)
 {
-        char *password;
+        char *password, *newpass;
         int authenticated = 0;
         int change;
-        u_int len;
+        u_int len, newlen;
+
         change = packet_get_char();
-        if (change)
-                logit("password change not supported");
         password = packet_get_string(&len);
+        if (change) {
+                /* discard new password from packet */
+                newpass = packet_get_string(&newlen);
+                memset(newpass, 0, newlen);
+                xfree(newpass);
+        }
         packet_check_eom();
-        if (PRIVSEP(auth_password(authctxt, password)) == 1
+
+        if (change)
+                logit("password change not supported");
+        else if (PRIVSEP(auth_password(authctxt, password)) == 1
 #ifdef HAVE_CYGWIN
             && check_nt_auth(1, authctxt->pw)
 #endif