Track tainted data and refuse to expand it

[exim.git] / src / src / auths / call_pam.c

diff --git a/src/src/auths/call_pam.c b/src/src/auths/call_pam.c
index 204f449d76c1122b6afa70a8dc9d5624321ee608..9a46b6b63c45c2156cb5c6b2df0ba5738d652a4e 100644 (file)
--- a/src/src/auths/call_pam.c
+++ b/src/src/auths/call_pam.c
@@ -71,9 +71,7 @@ struct pam_response *reply;
 
 if (pam_arg_ended) return PAM_CONV_ERR;
 
-reply = malloc(sizeof(struct pam_response) * num_msg);
-
-if (reply == NULL) return PAM_CONV_ERR;
+reply = store_get(sizeof(struct pam_response) * num_msg, FALSE);
 
 for (int i = 0; i < num_msg; i++)
   {
@@ -88,7 +86,7 @@ for (int i = 0; i < num_msg; i++)
       arg = US"";
       pam_arg_ended = TRUE;
       }
-    reply[i].resp = CS string_copy_malloc(arg); /* PAM frees resp */
+    reply[i].resp = CS string_copy_perm(arg, FALSE); /* PAM frees resp */
     reply[i].resp_retcode = PAM_SUCCESS;
     break;
 
@@ -99,7 +97,6 @@ for (int i = 0; i < num_msg; i++)
     break;
 
     default:  /* Must be an error of some sort... */
-    free (reply);
     pam_conv_had_error = TRUE;
     return PAM_CONV_ERR;
     }