[Pkg-samba-maint] Bug#395315: Sementation fault when using password component of pam_winbind

[Arne Nordmark]

Package: winbind
Version: 3.0.23c-2
Severity: normal


/usr/bin/passwd crashes with "Segmentation fault" when changing password.

passwd: password updated successfully
Segmentation fault

The password is acually changed OK, the crash comes during PAM cleanup.

The problem seems to be these lines form pam_sm_chauthtok() in
source/nsswitch/pam_winbind.c:

...
		time_t pwdlastset_prelim = 0;
...
		pam_set_data(pamh, PAM_WINBIND_PWD_LAST_SET, (void *)pwdlastset_prelim,  _pam_winbind_cleanup_func);
...

Although this strange type conversion from (time_t) to (void *) seems to work,
bad things happen when _pam_winbind_cleanup_func() cllas free() on the value
during PAM cleanup.

Using

pam_set_data( ... , NULL);

instead seems to resolve this problem (I do not know if NULL is allowed
for this argument. It seems to work).

Thanks
Arne

-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.17-2-amd64
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages winbind depends on:
ii  adduser                     3.97         Add and remove users and groups
ii  libc6                       2.3.6.ds1-4  GNU C Library: Shared libraries
ii  libcomerr2                  1.39-1       common error description library
ii  libkrb53                    1.4.4-3      MIT Kerberos runtime libraries
ii  libldap2                    2.1.30-13+b1 OpenLDAP libraries
ii  libpam0g                    0.79-3.2     Pluggable Authentication Modules l
ii  libpopt0                    1.10-3       lib for parsing cmdline parameters
ii  lsb-base                    3.1-15       Linux Standard Base 3.1 init scrip
ii  samba-common                3.0.23c-2    Samba common files used by both th

winbind recommends no packages.

-- no debconf information