Bug 24235 - polkit-agent-helper may call pam_end with a stale pam handle
Summary: polkit-agent-helper may call pam_end with a stale pam handle
Status: RESOLVED FIXED
Alias: None
Product: PolicyKit
Classification: Unclassified
Component: libpolkit (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: David Zeuthen (not reading bugmail)
QA Contact: David Zeuthen (not reading bugmail)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-09-30 15:13 UTC by Andreas Sandberg
Modified: 2009-10-21 10:14 UTC (History)
0 users

See Also:
i915 platform:
i915 features:

Attachments
Patch that sets pam_h to null after calling pam_end (323 bytes, patch)
2009-09-30 15:13 UTC, Andreas Sandberg 		Details | Splinter Review
View All

Description Andreas Sandberg 2009-09-30 15:13:37 UTC 
Created attachment 29960 [details] [review]
Patch that sets pam_h to null after calling pam_end

polkit-agent-helper calls pam_end on pam_h without setting pam_h to NULL. This causes the error handler to call pam_end on the stale handler if the send_dbus_message procedure fails, which in turn generates a SIGSEGV.
Comment 1 David Zeuthen (not reading bugmail) 2009-10-21 10:14:16 UTC 
(In reply to comment #0)
> Created an attachment (id=29960) [details]
> Patch that sets pam_h to null after calling pam_end
> 
> polkit-agent-helper calls pam_end on pam_h without setting pam_h to NULL. This
> causes the error handler to call pam_end on the stale handler if the
> send_dbus_message procedure fails, which in turn generates a SIGSEGV.
> 

Committed as f5e0b55. Thanks.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.