Re: S/Key bug?

[DrumFire <dpphln@tin.it>]

Here is the patch.

--- skeyinit.c.orig	Wed May  7 22:39:29 2003
+++ skeyinit.c	Tue Apr 13 09:49:47 2004
@@ -40,7 +40,7 @@
 
 void	usage(void);
 void	secure_mode(int *, char *, char *, size_t, char *, size_t);
-void	normal_mode(char *, int, char *, char *);
+void	normal_mode(char *, int, char *, char *, char *);
 void	timedout(int);
 void	convert_db(void);
 void	enable_db(int);
@@ -52,7 +52,7 @@
 	char	hostname[MAXHOSTNAMELEN];
 	char	seed[SKEY_MAX_SEED_LEN + 1];
 	char    buf[256], key[SKEY_BINKEY_SIZE], filename[PATH_MAX], *ht;
-	char    lastc, me[UT_NAMESIZE + 1], *p, *auth_type;
+	char    lastc, me[UT_NAMESIZE + 1],key2[SKEY_BINKEY_SIZE], *p, *auth_type;
 	u_int32_t noise;
 	struct skey skey;
 	struct passwd *pp;
@@ -300,7 +300,7 @@
 	if (!defaultsetup)
 		secure_mode(&n, key, seed, sizeof seed, buf, sizeof(buf));
 	else
-		normal_mode(pp->pw_name, n, key, seed);
+		normal_mode(pp->pw_name, n, key, seed, key2);
 	alarm(0);
 
 	/* XXX - why use malloc here? */
@@ -313,10 +313,14 @@
 	    pp->pw_name, skey_get_algorithm(), n, seed, skey.val);
 	(void)fclose(skey.keyfile);
 
-	(void)printf("\nID %s skey is otp-%s %d %s\n", pp->pw_name,
-	    skey_get_algorithm(), n, seed);
+	(void)printf("\nNext ID %s skey is otp-%s %d %s\n", pp->pw_name,
+	    skey_get_algorithm(), n - 1, seed);
+	
+        for(i=0;i<n-1;i++)
+		f(key2);	
+
 	(void)printf("Next login password: %s\n\n",
-	    hexmode ? put8(buf, key) : btoe(buf, key));
+	    hexmode ? put8(buf, key2) : btoe(buf, key2));
 	exit(0);
 }
 
@@ -402,10 +406,10 @@
 }
 
 void
-normal_mode(char *username, int n, char *key, char *seed)
+normal_mode(char *username, int n, char *key, char *seed, char *key2)
 {
 	int i, nn;
-	char passwd[SKEY_MAX_PW_LEN+2], key2[SKEY_BINKEY_SIZE];
+	char passwd[SKEY_MAX_PW_LEN+2];
 
 	/* Get user's secret passphrase */
 	for (i = 0; ; i++) {