Re: [Fwd: action.size can be used without previously being assigned to inpam_xauth.c]

[Nalin Dahyabhai <nalin redhat com>]

On Mon, Jan 07, 2002 at 11:21:27AM -0800, Andrew Morgan wrote:
> I'm not at all familiar with pam_xauth. Perhpas someone that ships it
> can offer some insight into this problem?
> 
> Thanks
> 
> Andrew
> Date: Thu, 3 Jan 2002 13:06:46 +0200 (IST)
> From: Shlomi Fish <shlomif@vipe.technion.ac.il>
> Subject: action.size can be used without previously being assigned to in
>  pam_xauth.c
> To: <morgan@kernel.org>
> 
> 
> In pam_xauth.c:
> 
> The function do_file makes use of an action struct. One of the things it
> does is trunacate its length to action.size and then mmap it. However, the
> function mangle_refcount calls it without necessarily assigning a.size to
> something.
> 
> This causes su to generate a very large file under
> ~/.xauth/refcount/root/localhost.localdomain/unix\:0 and then it dies with
> a "Bus Error" signal.
> 
> Please let me know when a fix is available.

The current pam errata package for Red Hat Linux should fix this
problem, as the pam_xauth module has had some radical surgery in the
last few months, removing refcounting altogether in favor of using
session-specific authority files.

The advisory can be found on line at
https://www.redhat.com/support/errata/RHBA-2001-149.html

Cheers,

Nalin