Created attachment 2784 [details] Patch file for this bug report Hello All, In reviewing code in OpenSSH-7.1p2, it would appear in file 'auth-pam.c', function 'sshpam_tty_conv()', there is a call to read_passphrase() which is not checked for a return value of NULL, indicating failure. The patch file below should address/correct this issue: --- auth-pam.c.orig 2016-02-13 09:44:14.656582235 -0800 +++ auth-pam.c 2016-02-13 09:46:14.583824370 -0800 @@ -982,6 +982,8 @@ reply[i].resp = read_passphrase(PAM_MSG_MEMBER(msg, i, msg), RP_ALLOW_STDIN); + if (reply[i].resp == NULL) + goto fail; reply[i].resp_retcode = PAM_SUCCESS; break; case PAM_PROMPT_ECHO_ON: ======================================================================= I am attaching the patch file to this bug report... Bill Parker (wp02855 at gmail dot com)
(In reply to Bill Parker from comment #0) > In reviewing code in OpenSSH-7.1p2, it would appear in file > 'auth-pam.c', > function 'sshpam_tty_conv()', there is a call to read_passphrase() > which is not checked for a return value of NULL, indicating failure. > The patch file below should address/correct this issue: [...] > reply[i].resp = > read_passphrase(PAM_MSG_MEMBER(msg, i, > msg), > RP_ALLOW_STDIN); > + if (reply[i].resp == NULL) > + goto fail; Thanks, but read_passphrase() can only return NULL if given the RP_ALLOW_EOF flag which this code doesn't, so in this case it's guaranteed to be non-NULL.
Close all resolved bugs after 7.3p1 release