[openssh-commits] [openssh] 08/87: fix arguable off-by-one in password expiry check

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit c27bc66a8cc79ed2985796c7807bbc404544ae86
Author: Damien Miller <djm at mindrot.org>
AuthorDate: Fri Oct 30 19:33:20 2026 +1100

    fix arguable off-by-one in password expiry check
    
    Old behaviour was to allow upto and including the expiry day, but this changes
    it to allow upto but _not_ including which apparently matches some other tools
    and libraries (e.g. Linux-PAM pam_unix.so).
    
    Anthropic ANT-2026-V1VNLWUV
---
 auth-shadow.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/auth-shadow.c b/auth-shadow.c
index 81b31b56e..f9a79e03c 100644
--- a/auth-shadow.c
+++ b/auth-shadow.c
@@ -44,8 +44,9 @@
 extern struct sshbuf *loginmsg;
 
 /*
- * For the account and password expiration functions, we assume the expiry
- * occurs the day after the day specified.
+ * For the password expiration function, we assume the expiry occurs the
+ * day after the day specified.  An account is expired from the day given
+ * by sp_expire onward, matching chage(1), login(1) and pam_unix(8).
  */
 
 /*
@@ -66,7 +67,7 @@ auth_shadow_acctexpired(struct spwd *spw)
 
 	if (spw->sp_expire == -1) {
 		debug3("account expiration disabled");
-	} else if (daysleft < 0) {
+	} else if (daysleft <= 0) {
 		logit("Account %.100s has expired", spw->sp_namp);
 		return 1;
 	} else if (daysleft <= spw->sp_warn) {

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.