greetings,
i've found a bug on pam_access while trying to set a username/host access.
whenever an ip address is used the search failes to find the entry.
i've traced the problem to some code added by Andrey V. Savochkin and
seems that is hitted by the change on the return address for snprintf, a
buffer that can get notnull terminated and the missing test of the
trailing "." that is supposed to be used to denote internet addreses.
the attached patch seems to fix the problem :
--- Linux-PAM/modules/pam_access/pam_access.c.inet Sun Jan 21 18:25:41 2001
+++ Linux-PAM/modules/pam_access/pam_access.c Thu Apr 26 09:22:19 2001
@@ -345,8 +345,9 @@
by "string" starts from "tok".
1998/01/27 Andrey V. Savochkin <saw@msu.ru>
*/
+
struct hostent *h;
- char hn[3+1+3+1+3+1+3+1];
+ char hn[3+1+3+1+3+1+3+1+1];
int r;
h = gethostbyname(string);
@@ -356,7 +357,7 @@
return (NO);
if (h->h_length != 4)
return (NO); /* only IPv4 addresses (SAW) */
- r = snprintf(hn, sizeof(hn), "%u.%u.%u.%u",
+ r = snprintf(hn, sizeof(hn), "%u.%u.%u.%u.",
(unsigned char)h->h_addr[0], (unsigned char)h->h_addr[1],
(unsigned char)h->h_addr[2], (unsigned char)h->h_addr[3]);
if (r < 0 || r >= sizeof(hn))
this patch has been applied to the latest CVS release and is supposed to
be current.
best regards,
Carlo
