@@ -854,21 +854,18 @@ sshpam_query(void *ctx, char **name, char **info,
854854{
855855 struct sshbuf * buffer ;
856856 struct pam_ctxt * ctxt = ctx ;
857- size_t plen ;
858857 u_char type ;
859858 char * msg ;
860- size_t len , mlen , nmesg = 0 ;
859+ size_t mlen , nmesg = 0 ;
861860 int r ;
862861
863862 debug3_f ("entering" );
864863 if ((buffer = sshbuf_new ()) == NULL )
865864 fatal_f ("sshbuf_new failed" );
866865 * name = xstrdup ("" );
867866 * info = xstrdup ("" );
868- * prompts = xmalloc (sizeof (char * ));
869- * * prompts = NULL ;
870- plen = 0 ;
871- * echo_on = xmalloc (sizeof (u_int ));
867+ * prompts = NULL ;
868+ * num = 0 ;
872869 ctxt -> pam_done = SshPamNone ;
873870
874871 while (ssh_msg_recv (ctxt -> pam_psock , buffer ) == 0 ) {
@@ -880,20 +877,17 @@ sshpam_query(void *ctx, char **name, char **info,
880877 switch (type ) {
881878 case PAM_PROMPT_ECHO_ON :
882879 case PAM_PROMPT_ECHO_OFF :
880+ * prompts = xcalloc (1 , sizeof (char * ));
881+ * echo_on = xcalloc (1 , sizeof (u_int ));
882+ (* prompts )[0 ] = msg ; /* transfer ownership */
883+ (* echo_on )[0 ] = (type == PAM_PROMPT_ECHO_ON );
883884 * num = 1 ;
884- len = plen + mlen + 1 ;
885- * * prompts = xreallocarray (* * prompts , 1 , len );
886- strlcpy (* * prompts + plen , msg , len - plen );
887- plen += mlen ;
888- * * echo_on = (type == PAM_PROMPT_ECHO_ON );
889- free (msg );
890885 sshbuf_free (buffer );
891886 return (0 );
892887 case PAM_ERROR_MSG :
893888 case PAM_TEXT_INFO :
894- * num = 0 ;
895889 free (* info );
896- * info = msg ; /* Steal the message */
890+ * info = msg ; /* transfer ownership */
897891 msg = NULL ;
898892 ctxt -> pam_done = SshPamAgain ;
899893 sshbuf_free (buffer );
@@ -907,29 +901,8 @@ sshpam_query(void *ctx, char **name, char **info,
907901 /* FALLTHROUGH */
908902 case PAM_AUTH_ERR :
909903 debug3 ("PAM: %s" , pam_strerror (sshpam_handle , type ));
910- if (* * prompts != NULL && strlen (* * prompts ) != 0 ) {
911- free (* info );
912- * info = * * prompts ;
913- * * prompts = NULL ;
914- * num = 0 ;
915- * * echo_on = 0 ;
916- ctxt -> pam_done = SshPamError ;
917- free (msg );
918- sshbuf_free (buffer );
919- return 0 ;
920- }
921904 /* FALLTHROUGH */
922905 case PAM_SUCCESS :
923- if (* * prompts != NULL ) {
924- /* drain any accumulated messages */
925- debug ("PAM: %s" , * * prompts );
926- if ((r = sshbuf_put (loginmsg , * * prompts ,
927- strlen (* * prompts ))) != 0 )
928- fatal ("%s: buffer error: %s" ,
929- __func__ , ssh_err (r ));
930- free (* * prompts );
931- * * prompts = NULL ;
932- }
933906 if (type == PAM_SUCCESS ) {
934907 if (!sshpam_authctxt -> valid ||
935908 (sshpam_authctxt -> pw -> pw_uid == 0 &&
@@ -938,8 +911,6 @@ sshpam_query(void *ctx, char **name, char **info,
938911 "succeeded when it should have "
939912 "failed" );
940913 import_environments (buffer );
941- * num = 0 ;
942- * * echo_on = 0 ;
943914 ctxt -> pam_done = SshPamAuthenticated ;
944915 free (msg );
945916 sshbuf_free (buffer );
@@ -950,8 +921,6 @@ sshpam_query(void *ctx, char **name, char **info,
950921 sshpam_authctxt -> user , sshpam_rhost );
951922 /* FALLTHROUGH */
952923 default :
953- * num = 0 ;
954- * * echo_on = 0 ;
955924 free (msg );
956925 ctxt -> pam_done = SshPamError ;
957926 sshbuf_free (buffer );
0 commit comments