- (dtucker) [auth-pam.c] Ensure that only one side of the authentication

   socketpair stays open on in both the monitor and PAM process.  Patch from
   Joerg Sonnenberger.

diff --git a/ChangeLog b/ChangeLog
index e3ae468d75d038afadd60fdfe9d02c215ca9daa0..8dfa0c0713e4857f7703e03970d2a10d1c7d3ee8 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+20050716
+ - (dtucker) [auth-pam.c] Ensure that only one side of the authentication
+   socketpair stays open on in both the monitor and PAM process.  Patch from
+   Joerg Sonnenberger.
+
 20050714
  - (dtucker) OpenBSD CVS Sync
    - dtucker@cvs.openbsd.org 2005/07/06 09:33:05

diff --git a/auth-pam.c b/auth-pam.c
index d25cff3750585551d02442709369c5d629184301..29dd2c974df1a8c0b2d8d8a75485aad2d4ff6912 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -157,6 +157,7 @@ pthread_create(sp_pthread_t *thread, const void *attr __unused,
     void *(*thread_start)(void *), void *arg)
 {
        pid_t pid;
+       struct pam_ctxt *ctx = arg;
 
        sshpam_thread_status = -1;
        switch ((pid = fork())) {
@@ -164,10 +165,14 @@ pthread_create(sp_pthread_t *thread, const void *attr __unused,
                error("fork(): %s", strerror(errno));
                return (-1);
        case 0:
+               close(ctx->pam_psock);
+               ctx->pam_psock = -1;
                thread_start(arg);
                _exit(1);
        default:
                *thread = pid;
+               close(ctx->pam_csock);
+               ctx->pam_csock = -1;
                sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler);
                return (0);
        }