avoid sending pointer values in struct passwd
Yuichiro NAITO
naito.yuichiro at gmail.com
Fri Nov 20 13:59:21 AEDT 2020
Hi, I wrote a patch to improve sending struct passwd value.
And I believe one ToDo comment will be finished.
When ssh forks child process for authentication,
parent process proxies pwnamallow() execution in mm_answer_pwnamallow().
Through this proxy, struct passwd values are sent via UNIX domain socket.
That includes pointer values because whole structure memory is copied
by memcpy() .
Fortunately all pointer members are replaced by actual strings
(e.g. pw_name, pw_passwd, ...) for now.
But if a new pointer member is added, it will never be rewritten and can be a
wild pointer. My patch avoids this.
Take a look at my GitHub pull request to see my patch.
https://github.com/openssh/openssh-portable/pull/216
Thank you!
--
Yuichiro NAITO (naito.yuichiro at gmail.com)
More information about the openssh-unix-dev
mailing list