polkit-agent-helper-1 segfaults if send_dbus_message fails

[Andreas Sandberg]

Binary package hint: policykit-1

polkit-agent-helper-1 does not set the pam handle to NULL after calling pam_end. This causes the error handler to call pam_end on the stale handle if send_dbus_message fails.

ProblemType: Bug
Architecture: amd64
Date: Wed Sep 30 23:19:54 2009
DistroRelease: Ubuntu 9.10
NonfreeKernelModules: fglrx
Package: policykit-1 0.94-1
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-11.36-generic
SourcePackage: policykit-1
Uname: Linux 2.6.31-11-generic x86_64

[Andreas Sandberg (andysan)]

Binary package hint: policykit-1

polkit-agent-helper-1 does not set the pam handle to NULL after calling pam_end. This causes the error handler to call pam_end on the stale handle if send_dbus_message fails.

ProblemType: Bug
Architecture: amd64
Date: Wed Sep 30 23:19:54 2009
DistroRelease: Ubuntu 9.10
NonfreeKernelModules: fglrx
Package: policykit-1 0.94-1
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-11.36-generic
SourcePackage: policykit-1
Uname: Linux 2.6.31-11-generic x86_64

[Zeuthen (zeuthen)]

(In reply to comment #0)
> Created an attachment (id=29960) [details]
> Patch that sets pam_h to null after calling pam_end
>
> polkit-agent-helper calls pam_end on pam_h without setting pam_h to NULL. This
> causes the error handler to call pam_end on the stale handler if the
> send_dbus_message procedure fails, which in turn generates a SIGSEGV.
>

Committed as f5e0b55. Thanks.

[Jonathan Thomas (echidnaman)]

The patch should be included in the most current release now. Thanks. :)