Menu

#248 mod_auth_pam in endless loop with empty username

open
nobody
None
5
2004-07-13
2004-07-13
No

If the webbrowser sends an empty username, the pam
module loops and allocates through strdup more and
more memory until memory is exhausted.
My fix is to return AUTH_REQUIRED immediately if an
empty username is detected:

/* this is only set after get_basic_auth_pw was
called */
userinfo.name = r->connection->user;

if(userinfo.name[0] == 0 ) return AUTH_REQUIRED;
// Disallow empty names
// Not good for PAM (endless loop)

Discussion


Log in to post a comment.