From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i586; en-US; rv:1.4.2) Gecko/20040308 Description of problem: The pam modules leak memory and file descriptors. Mostly during error conditions, but in at least 1 module, pam_succeed_if, memory is lost on every write to syslog. The sha1 portion of pam_timestamp was also incorrectly erasing memory. Version-Release number of selected component (if applicable): pam-0.77-36 How reproducible: Always Steps to Reproduce: This problem was found by code review after noticing all kinds of memory leaks with valgrind while playing with sshd. Additional info: I have a patch that I will create as an attachment. Please look at it and consider applying all or some of it before fedora core 2 final is released. I feel there are some security implications with this package in its current state. Either by consuming too much memory and killing the daemon or leaving file decriptors to potentially sensitive information open.
Created attachment 99091 [details] Patch that closes all pam resource leaks that I can find Please consider applying this patch !!!
Created attachment 99911 [details] Revised patch The new patch corrects more problems than the original.
Created attachment 100084 [details] Revised patch The patch was updated based on feedback from Dmitry Levin.
Created attachment 100514 [details] Updated patch The patch is now sync'ed against pam-0.77-40.
Done