From be4b9f4aaa28269eadc572f7d02a8f04085a9609 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 23 Jun 2026 19:11:06 +0200 Subject: [PATCH] xauth-pam: Properly initialize response array when handling sessions This is documented as a requirement in the man page, so the caller of the conversation function might expect such an array. Although, since we only accept non-interactive requests, for which no response is expected, it's doubtful whether it will actually try to access elements in the array. And if the passed pointer was initialized to NULL, passing it to free() is probably also fine. Fixes: 2312504d1ef5 ("xauth-pam: Open/close a PAM session for each connected client") --- src/libcharon/plugins/xauth_pam/xauth_pam_listener.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libcharon/plugins/xauth_pam/xauth_pam_listener.c b/src/libcharon/plugins/xauth_pam/xauth_pam_listener.c index eb06f54bb..5b77b99e2 100644 --- a/src/libcharon/plugins/xauth_pam/xauth_pam_listener.c +++ b/src/libcharon/plugins/xauth_pam/xauth_pam_listener.c @@ -65,7 +65,8 @@ static int conv(int num_msg, const struct pam_message **msg, return PAM_CONV_ERR; } } - return PAM_SUCCESS; + *resp = calloc(num_msg, sizeof(struct pam_response)); + return (*resp || !num_msg) ? PAM_SUCCESS : PAM_BUF_ERR; } METHOD(listener_t, ike_updown, bool,