openssh unix dev - Nov 2020 - avoid sending pointer values in struct passwd

Hi, I wrote a patch to improve sending struct passwd value.
And I believe one ToDo comment will be finished.

When ssh forks child process for authentication,
parent process proxies pwnamallow() execution in mm_answer_pwnamallow().

Through this proxy, struct passwd values are sent via UNIX domain socket.
That includes pointer values because whole structure memory is copied
by memcpy() .
Fortunately all pointer members are replaced by actual strings
(e.g. pw_name, pw_passwd, ...) for now.

But if a new pointer member is added, it will never be rewritten and can be a
wild pointer. My patch avoids this.

Take a look at my GitHub pull request to see my patch.

https://github.com/openssh/openssh-portable/pull/216

Thank you!

-- 
Yuichiro NAITO (naito.yuichiro at gmail.com)

Yuichiro NAITO wrote:
> Take a look at my GitHub pull request to see my patch.
> 
> https://github.com/openssh/openssh-portable/pull/216
I think the length at the beginning should be tied to the (number of?)
members that are sent instead of the struct passwd size on either side.

Also, adding passwd.fields seems to be an unrelated change, better
placed in a separate commit.

Finally, sshbuf_free_passwd() is added but never called. If it is not
needed then I think it's better to not add it (yet).


//Peter