upstream commit

avoid modifying pw->pw_passwd; let endpwent() clean up
for us, but keep a scrubbed copy; bz2777, ok dtucker@

OpenBSD-Commit-ID: 715afc0f59c6b82c4929a73279199ed241ce0752

1 files changed, 2 insertions, 4 deletions

diff --git a/sshd.c b/sshd.c
index a69537bc8..858dd45a8 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.499 2017/11/14 00:45:29 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.500 2018/01/23 05:01:15 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1695,10 +1695,8 @@ main(int ac, char **av)
                         fatal("Privilege separation user %s does not exist",
                             SSH_PRIVSEP_USER);
         } else {
-                explicit_bzero(privsep_pw->pw_passwd,
-                    strlen(privsep_pw->pw_passwd));
                 privsep_pw = pwcopy(privsep_pw);
-                free(privsep_pw->pw_passwd);
+                freezero(privsep_pw->pw_passwd, strlen(privsep_pw->pw_passwd));
                 privsep_pw->pw_passwd = xstrdup("*");
         }
         endpwent();