Clean up bugs in PAM_DATA_SILENT

We still need to free the Kerberos context, we just don't want to
destroy the cache.  Also fix a memory leak in the PAM testing
parser.

diff --git a/module/context.c b/module/context.c
index dd2fa0004e71fd1a458d2ba1554859be69f6a440..bd90f51f55490e9ba9b877cf73a3fb609023679a 100644 (file)
--- a/module/context.c
+++ b/module/context.c
@@ -164,14 +164,14 @@ pamk5_context_destroy(pam_handle_t *pamh UNUSED, void *data,
     struct context *ctx = (struct context *) data;
 
     /*
-     * Do nothing if the status contains PAM_DATA_SILENT, since in that case we
-     * may be in a child and the parent will still rely on underlying resources
-     * such as the ticket cache to exist.
+     * Do not destroy the cache if the status contains PAM_DATA_SILENT, since
+     * in that case we may be in a child and the parent will still rely on
+     * underlying resources such as the ticket cache to exist.
      */
-    if (PAM_DATA_SILENT != 0 && pam_end_status & PAM_DATA_SILENT)
-        return;
+    if (PAM_DATA_SILENT != 0 && (pam_end_status & PAM_DATA_SILENT))
+        ctx->dont_destroy_cache = true;
 
-    /* Otherwise, just call context_free. */
+    /* The rest of the work is in context_free. */
     if (ctx != NULL)
         context_free(ctx, true);
 }

diff --git a/tests/fakepam/config.c b/tests/fakepam/config.c
index d89586d9d38562246497e7e499001e9e5305255e..8e0685604d556864362fb41d65e620223bc94c95 100644 (file)
--- a/tests/fakepam/config.c
+++ b/tests/fakepam/config.c
@@ -610,6 +610,7 @@ parse_end(FILE *script)
             flags |= string_to_status(flag);
             flag = strtok(NULL, "|");
         }
+        free(line);
     }
     if (line != NULL) {
         free(line);

diff --git a/tests/fakepam/script.c b/tests/fakepam/script.c
index 7198b1dabc32cad64e0bd1c0c8f5225a560b9535..6f3812577960d0552bbc21147748844dcad96491 100644 (file)
--- a/tests/fakepam/script.c
+++ b/tests/fakepam/script.c
@@ -302,10 +302,7 @@ run_script(const char *file, const struct script_config *config)
     if (config->oldauthtok != NULL)
         pamh->oldauthtok = bstrdup(config->oldauthtok);
 
-    /*
-     * Run the actions and check their return status.  If one of the actions
-     * is to call pam_end, we have to call any callback before then.
-     */
+    /* Run the actions and check their return status. */
     for (action = work->actions; action != NULL; action = action->next) {
         if (work->options[action->group].argv == NULL)
             status = (*action->call)(pamh, action->flags, 0, argv_empty);
@@ -320,7 +317,7 @@ run_script(const char *file, const struct script_config *config)
     check_output(work->output, output);
     pam_output_free(output);
 
-    /* If we have a test callback we haven't called, call it now. */
+    /* If we have a test callback, call it now. */
     if (config->callback != NULL)
         config->callback(pamh, config, config->data);