Only free allocated memory on UnixWare

[stoeckmann]

If libaif is compiled in together with shadow support, then a
misconfigured system could trigger invalid free calls:

The "spw" variable can be NULL even though a password entry
exists. This can be reproduced on systems with shadow support if
/etc/shadow lacks a user entry which exists in /etc/passwd: Thus
it requires a misconfigured system to trigger this bug.

If "spw" is NULL then get_iaf_password is never called, which
means that "passwd" still points to memory within the pw struct.

Shoutout to @c3h2_ctf

[daztucker]

I agree with your analysis and that this fixes it, but the whole section of code is not very clear and this makes it less so. Instead, I'd suggest keeping another copy of the pointer and using that which would make it clearer what's being freed and why, ie

char *iaf_passwd = NULL;
[...]          
iaf_passwd = passwd = get_iaf_password(pw);
[...]
free((void *) iaf_passwd(iaf_passwd);  /* maybe zero it too */

but I think all of the locked account check could be factored out into its own function in platform.c, which would clean up auth.c quite a bit.

[daztucker]

It'd look like this (untested): daztucker@b964748

[stoeckmann]

Looks definitely much better and removes this nested portability handling out of auth.c. Definitely agreeing on that proposal.

[daztucker]

I've committed the proposed patch as 2923d02. Thanks for the report.