Print this page
10104 pam_set_data() dereferences pointer before checking for NULL


   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 




  26 #include <syslog.h>
  27 #include <dlfcn.h>
  28 #include <sys/types.h>
  29 #include <sys/stat.h>
  30 #include <stdlib.h>
  31 #include <strings.h>
  32 #include <malloc.h>
  33 #include <unistd.h>
  34 #include <fcntl.h>
  35 #include <errno.h>
  36 
  37 #include <security/pam_appl.h>
  38 #include <security/pam_modules.h>
  39 #include <sys/mman.h>
  40 
  41 #include <libintl.h>
  42 
  43 #include "pam_impl.h"
  44 
  45 static char *pam_snames [PAM_NUM_MODULE_TYPES] = {


 780          * finally, get PAM_USER. We have to call pam_get_item to get
 781          * the value of user because pam_set_item mallocs the memory.
 782          */
 783 
 784         status = pam_get_item(pamh, PAM_USER, (void**)user);
 785         return (status);
 786 }
 787 
 788 /*
 789  * Set module specific data
 790  */
 791 
 792 int
 793 pam_set_data(pam_handle_t *pamh, const char *module_data_name, void *data,
 794     void (*cleanup)(pam_handle_t *pamh, void *data, int pam_end_status))
 795 {
 796         struct pam_module_data *psd;
 797 
 798         pam_trace(PAM_DEBUG_DATA,
 799             "pam_set_data(%p:%s:%d)=%p", (void *)pamh,
 800             module_data_name ? module_data_name : "NULL", pamh->pam_inmodule,
 801             data);
 802         if (pamh == NULL || (pamh->pam_inmodule != WO_OK) ||
 803             module_data_name == NULL) {
 804                 return (PAM_SYSTEM_ERR);
 805         }
 806 
 807         /* check if module data already exists */
 808 
 809         for (psd = pamh->ssd; psd; psd = psd->next) {
 810                 if (strcmp(psd->module_data_name, module_data_name) == 0) {
 811                         /* clean up original data before setting the new data */
 812                         if (psd->cleanup) {
 813                                 psd->cleanup(pamh, psd->data, PAM_SUCCESS);
 814                         }
 815                         psd->data = (void *)data;
 816                         psd->cleanup = cleanup;
 817                         return (PAM_SUCCESS);
 818                 }
 819         }
 820 
 821         psd = malloc(sizeof (struct pam_module_data));




   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 
  26 /*
  27  * Copyright (c) 2019, Joyent, Inc.
  28  */
  29 
  30 #include <syslog.h>
  31 #include <dlfcn.h>
  32 #include <sys/types.h>
  33 #include <sys/stat.h>
  34 #include <stdlib.h>
  35 #include <strings.h>
  36 #include <malloc.h>
  37 #include <unistd.h>
  38 #include <fcntl.h>
  39 #include <errno.h>
  40 
  41 #include <security/pam_appl.h>
  42 #include <security/pam_modules.h>
  43 #include <sys/mman.h>
  44 
  45 #include <libintl.h>
  46 
  47 #include "pam_impl.h"
  48 
  49 static char *pam_snames [PAM_NUM_MODULE_TYPES] = {


 784          * finally, get PAM_USER. We have to call pam_get_item to get
 785          * the value of user because pam_set_item mallocs the memory.
 786          */
 787 
 788         status = pam_get_item(pamh, PAM_USER, (void**)user);
 789         return (status);
 790 }
 791 
 792 /*
 793  * Set module specific data
 794  */
 795 
 796 int
 797 pam_set_data(pam_handle_t *pamh, const char *module_data_name, void *data,
 798     void (*cleanup)(pam_handle_t *pamh, void *data, int pam_end_status))
 799 {
 800         struct pam_module_data *psd;
 801 
 802         pam_trace(PAM_DEBUG_DATA,
 803             "pam_set_data(%p:%s:%d)=%p", (void *)pamh,
 804             (module_data_name != NULL) ? module_data_name : "NULL",
 805             (pamh != NULL) ? pamh->pam_inmodule : -1, data);
 806         if (pamh == NULL || (pamh->pam_inmodule != WO_OK) ||
 807             module_data_name == NULL) {
 808                 return (PAM_SYSTEM_ERR);
 809         }
 810 
 811         /* check if module data already exists */
 812 
 813         for (psd = pamh->ssd; psd; psd = psd->next) {
 814                 if (strcmp(psd->module_data_name, module_data_name) == 0) {
 815                         /* clean up original data before setting the new data */
 816                         if (psd->cleanup) {
 817                                 psd->cleanup(pamh, psd->data, PAM_SUCCESS);
 818                         }
 819                         psd->data = (void *)data;
 820                         psd->cleanup = cleanup;
 821                         return (PAM_SUCCESS);
 822                 }
 823         }
 824 
 825         psd = malloc(sizeof (struct pam_module_data));