DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding; q=dns; s=
	default; b=wirdDO7oE3+g0znU5hj3w5lHfsZEOpiv7KLbiCOZofv/OtP+zjLOY
	BrLpRKr0qGFjPnI4hr83nR36QhpGB5c3Q/lu45XkJ+T3xDQ3JSA+IffWBBvytOTN
	EC8RQY2Qu1f4wfzl8SSkEYYHbUfpuhLt0P+6mSl7s4IZKaC5xblU8Y=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
To: cygwin@cygwin.com
From: Andrew Schulman <schulman.andrew@epa.gov>
Subject: Re: snapshot 05/05: ssh segmentation fault within screen
Date: Wed, 07 May 2014 11:16:54 -0400
Lines: 29
Message-ID: <avikm99d63ccuk9lt1v6l39uo89c6dksfr@4ax.com>
References: <5368525F.2070301@shaddybaddah.name> <20140506163936.GY30918@calimero.vinschen.de> <536920BB.3080102@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

> On 05/06/2014 10:39 AM, Corinna Vinschen wrote:
> 
> > The problem, which I totally not realized since I started implementing
> > this stuff is, that by propagating this cache to child processes, said
> > child processes suffer from what the parent process does to the passwd
> > structures in the cache.
> > 
> > Screen seems to call getpwuid and then sets some of the pointers in the
> > passwd structure it got from the call to NULL, apparently for some sort
> > of security, this way overwriting the cached passwd struct for the
> 
> Bug in screen.  POSIX states:
> 
> http://pubs.opengroup.org/onlinepubs/9699919799/functions/getpwuid.html
> 
> The application shall not modify the structure to which the return value
> points, nor any storage areas pointed to by pointers within the
> structure. The returned pointer, and pointers within the structure,
> might be invalidated or the structure or the storage areas might be
> overwritten by a subsequent call to getpwent(), getpwnam(), or getpwuid().

Fixing this would be well out of my depth, but I'll gladly include any
patches to screen that fix it.

Meanwhile there's a new release of screen (4.2.1) upstream, about one year
newer than the last commit I packaged for Cygwin, so maybe this problem has
already been addressed.  I'll get the new release out ASAP so we can test.

Andrew


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple