diff options
author | Damien Miller <djm@mindrot.org> | 2015-08-11 13:34:12 +1000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2015-08-11 13:36:00 +1000 |
commit | 5e75f5198769056089fb06c4d738ab0e5abc66f7 (patch) | |
tree | 939fc57f4ad54019d9d749abaa2e2d4b606a9116 | |
parent | d4697fe9a28dab7255c60433e4dd23cf7fce8a8b (diff) |
set sshpam_ctxt to NULL after free
Avoids use-after-free in monitor when privsep child is compromised.
Reported by Moritz Jodeit; ok dtucker@
-rw-r--r-- | monitor.c | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -1166,14 +1166,16 @@ mm_answer_pam_respond(int sock, Buffer *m) int mm_answer_pam_free_ctx(int sock, Buffer *m) { + int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt; debug3("%s", __func__); (sshpam_device.free_ctx)(sshpam_ctxt); + sshpam_ctxt = sshpam_authok = NULL; buffer_clear(m); mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m); auth_method = "keyboard-interactive"; auth_submethod = "pam"; - return (sshpam_authok == sshpam_ctxt); + return r; } #endif |