2 files changed, 5 insertions, 2 deletions

diff --git a/auth-pam.c b/auth-pam.c
index 361573807..701d85b64 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -97,11 +97,11 @@ sshpam_sigchld_handler(int sig)
         if (cleanup_ctxt == NULL)
                 return; /* handler called after PAM cleanup, shouldn't happen */
         if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
-             == -1) {
+             <= 0) {
                 /* PAM thread has not exitted, privsep slave must have */
                 kill(cleanup_ctxt->pam_thread, SIGTERM);
                 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
-                    == -1)
+                    <= 0)
                         return; /* could not wait */
         }
         if (WIFSIGNALED(sshpam_thread_status) &&
diff --git a/debian/changelog b/debian/changelog
index dbdabf05d..71a58cf2a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -7,6 +7,9 @@ openssh (1:3.8.1p1-5) UNRELEASED; urgency=low
   * Disable shadow password support in openssh-server-udeb.
   * Fix non-portable shell constructs in maintainer scripts (thanks, David
     Weinehall; partial fix for #258517).
+  * Apply patch from Darren Tucker to make the PAM authentication SIGCHLD
+    handler kill the PAM thread if its waitpid() call returns 0, as well as
+    the previous check for -1 (closes: #252676).
 
  -- Colin Watson <cjwatson@debian.org>  Wed,  2 Jun 2004 14:26:18 -0300