New version

- Dropped strdup-null-check patch (upstreamed)
epel9
Jaroslav Škarvada 10 years ago
parent 446d133950
commit 4ed1ade270

1
.gitignore vendored

@ -2,3 +2,4 @@
/oath-toolkit-2.2.0.tar.gz
/oath-toolkit-2.4.0.tar.gz
/oath-toolkit-2.4.1.tar.gz
/oath-toolkit-2.6.0.tar.gz

@ -1,29 +0,0 @@
diff --git a/pam_oath/pam_oath.c b/pam_oath/pam_oath.c
index 8379358..e2d3363 100644
--- a/pam_oath/pam_oath.c
+++ b/pam_oath/pam_oath.c
@@ -146,6 +146,12 @@ pam_sm_authenticate (pam_handle_t * pamh,
char *query_prompt = NULL;
char *onlypasswd = strdup (""); /* empty passwords never match */
+ if (!onlypasswd)
+ {
+ retval = PAM_BUF_ERR;
+ goto done;
+ }
+
parse_cfg (flags, argc, argv, &cfg);
retval = pam_get_user (pamh, &user, NULL);
@@ -265,6 +271,11 @@ pam_sm_authenticate (pam_handle_t * pamh,
{
free (onlypasswd);
onlypasswd = strdup (password);
+ if (!onlypasswd)
+ {
+ retval = PAM_BUF_ERR;
+ goto done;
+ }
/* user entered their system password followed by generated OTP? */

@ -1,23 +1,19 @@
Name: oath-toolkit
Version: 2.4.1
Release: 9%{?dist}
Version: 2.6.0
Release: 1%{?dist}
License: GPLv3+
Group: System Environment/Libraries
Summary: One-time password components
BuildRequires: pam-devel, gtk-doc, libtool, libtool-ltdl-devel
BuildRequires: xmlsec1-devel, xmlsec1-openssl-devel, autoconf, automake
Source0: http://download.savannah.gnu.org/releases/%{name}/%{name}-%{version}.tar.gz
# Workaround for upstream issue #108719
Source1: http://git.savannah.gnu.org/cgit/oath-toolkit.git/plain/libpskc/man/gdoc
URL: http://www.nongnu.org/oath-toolkit/
# Escape leading single quotes in man pages which are misinterpreted as macros,
# patch sent upstream, upstream ticket #108312
Patch0: oath-toolkit-2.0.2-man-fix.patch
# Add null check to strdup calls, upstream ticket #108456
Patch1: oath-toolkit-2.4.1-strdup-null-check.patch
# Fix invalid reads due to references to old (freed) xmlDoc,
# upstream ticket #108736
Patch2: oath-toolkit-2.4.1-retain-original-xmldoc.patch
Patch1: oath-toolkit-2.4.1-retain-original-xmldoc.patch
%description
The OATH Toolkit provide components for building one-time password
@ -125,14 +121,7 @@ A PAM module for pluggable login authentication for OATH.
%prep
%setup -q
%patch0 -p1 -b .man-fix
%patch1 -p1 -b .strdup-null-check
%patch2 -p1 -b .retain-original-xmldoc.patch
# Workaround for upstream issue #108719
cp %{SOURCE1} libpskc/man/gdoc
chmod 755 libpskc/man/gdoc
cp %{SOURCE1} liboath/man/gdoc
chmod 755 liboath/man/gdoc
%patch1 -p1 -b .retain-original-xmldoc.patch
autoreconf -fi
@ -209,6 +198,10 @@ mkdir -p -m 0600 %{buildroot}%{_sysconfdir}/liboath
%{_libdir}/security/pam_oath.so
%changelog
* Thu May 21 2015 Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.0-1
- New version
- Dropped strdup-null-check patch (upstreamed)
* Fri Jan 30 2015 Jaroslav Škarvada <jskarvad@redhat.com> - 2.4.1-9
- Fixed invalid reads in libpskc due to references to old (freed) xmlDoc
(by retain-original-xmldoc patch), patch provided by David Woodhouse

@ -1 +1 @@
951bafd1d86e6013903c10be3b6623bb oath-toolkit-2.4.1.tar.gz
f19f1c47eb7d1c609b3e244876b9ce63 oath-toolkit-2.6.0.tar.gz

Loading…
Cancel
Save