Re: radiusd(8) bsdauth crashes if user authenticates with a mechanism ":style" and group checking on

2019-12-16 Thread Dennis Lindroos
Hi guys, Brilliant! Didn't know about strcspn() myself.. Now i tested and confirmed to work (both with and without auth style). Let me know if there's anything i can help. BR, Dennis ^^ OpenBSD/Finland (alpha,x86) since ca 2000 ^^ On Sat, 14 Dec 2019 at 17:15, Todd C. Miller wrote: > On Fri,

Re: radiusd(8) bsdauth crashes if user authenticates with a mechanism ":style" and group checking on

2019-12-14 Thread Todd C . Miller
On Fri, 13 Dec 2019 22:37:31 +0200, Dennis Lindroos wrote: > If the user argument has the ":style" suffix attached to it then > getpwnam(user) will return a NULL pointer. > I tried just using strsep(3) to strip off the auth style and it works for > me (this is probably not the safest bit of

Re: radiusd(8) bsdauth crashes if user authenticates with a mechanism ":style" and group checking on

2019-12-13 Thread Theo de Raadt
+ user = strsep(, ":"); Can't that also return NULL?

radiusd(8) bsdauth crashes if user authenticates with a mechanism ":style" and group checking on

2019-12-13 Thread Dennis Lindroos
Hi guys, Discovered this SEGV when trying out radiusd with bsdauth and an alternative user auth mechanism, when group checking is enabled. If the user argument has the ":style" suffix attached to it then getpwnam(user) will return a NULL pointer. I tried just using strsep(3) to strip off the