Use calloc(3) instead of malloc(3). "accounting" is used without

initialization. Also don't check request authenticator for other than
Accounting-Request.

diff --git a/usr.sbin/radiusd/parse.y b/usr.sbin/radiusd/parse.y
index c43cd50..c1aac39 100644 (file)
--- a/usr.sbin/radiusd/parse.y
+++ b/usr.sbin/radiusd/parse.y
@@ -1,4 +1,4 @@
-/*     $OpenBSD: parse.y,v 1.22 2024/07/10 16:30:43 yasuoka Exp $      */
+/*     $OpenBSD: parse.y,v 1.23 2024/07/13 13:06:47 yasuoka Exp $      */
 
 /*
  * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -135,7 +135,7 @@ include             : INCLUDE STRING                {
 listen         : LISTEN ON listen_addr {
                        struct radiusd_listen *n;
 
-                       if ((n = malloc(sizeof(struct radiusd_listen)))
+                       if ((n = calloc(1, sizeof(struct radiusd_listen)))
                            == NULL) {
 outofmemory:
                                yyerror("Out of memory: %s", strerror(errno));
@@ -917,7 +917,7 @@ parse_config(const char *filename, struct radiusd *radiusd)
        popfile();
 
        if (TAILQ_EMPTY(&conf->listen)) {
-               if ((l = malloc(sizeof(struct radiusd_listen))) == NULL) {
+               if ((l = calloc(1, sizeof(struct radiusd_listen))) == NULL) {
                        log_warn("Out of memory");
                        return (-1);
                }

diff --git a/usr.sbin/radiusd/radiusd.c b/usr.sbin/radiusd/radiusd.c
index 6825f89..3409b25 100644 (file)
--- a/usr.sbin/radiusd/radiusd.c
+++ b/usr.sbin/radiusd/radiusd.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: radiusd.c,v 1.46 2024/07/10 16:30:43 yasuoka Exp $    */
+/*     $OpenBSD: radiusd.c,v 1.47 2024/07/13 13:06:47 yasuoka Exp $    */
 
 /*
  * Copyright (c) 2013, 2023 Internet Initiative Japan Inc.
@@ -475,9 +475,9 @@ radiusd_listen_handle_packet(struct radiusd_listen *listn,
        }
 
        /* Check the request authenticator if accounting */
-       if ((req_code == RADIUS_CODE_ACCOUNTING_REQUEST ||
-           listn->accounting) && radius_check_accounting_request_authenticator(
-           packet, client->secret) != 0) {
+       if (req_code == RADIUS_CODE_ACCOUNTING_REQUEST &&
+           radius_check_accounting_request_authenticator(packet,
+           client->secret) != 0) {
                log_warnx("Received %s(code=%d) from %s id=%d: bad request "
                    "authenticator", radius_code_string(req_code), req_code,
                    peerstr, req_id);