obsolete-buildroot/sources/openwrt/patches/ppp/auth_hook_segfault

   1 To: md@linux.it, mjt@corpit.ru
   2 Subject: pppd-auth-hook.patch
   3 Message-Id: <20040604231517.3E9AD11DC4@paltus.tls.msk.ru>
   4 Date: Sat,  5 Jun 2004 03:15:17 +0400 (MSD)
   5 From: mjt@corpit.ru (Michael Tokarev)
   6
   7 The patch below fixes pppd segfault when using auth_hook that sets
   8 options for the user (use-after-free problem).
   9
  10 /mjt
  11
  12 --- ppp/pppd/auth.c.orig        Mon Jun 23 18:12:04 2003
  13 +++ ppp/pppd/auth.c     Sat Jun  5 03:11:36 2004
  14 @@ -1251,14 +1251,14 @@
  15      if (pap_auth_hook) {
  16         ret = (*pap_auth_hook)(user, passwd, msg, &addrs, &opts);
  17         if (ret >= 0) {
  18 +           /* note: set_allowed_addrs() saves opts (but not addrs): don't free it! */
  19             if (ret)
  20                 set_allowed_addrs(unit, addrs, opts);
  21 -           BZERO(passwd, sizeof(passwd));
  22 +           else if (opts != 0)
  23 +               free_wordlist(opts);
  24             if (addrs != 0)
  25                 free_wordlist(addrs);
  26 -           if (opts != 0) {
  27 -               free_wordlist(opts);
  28 -           }
  29 +           BZERO(passwd, sizeof(passwd));
  30             return ret? UPAP_AUTHACK: UPAP_AUTHNAK;
  31         }
  32      }
  33