===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/auth2-passwd.c,v
retrieving revision 1.2
retrieving revision 1.2.8.2
diff -u -r1.2 -r1.2.8.2
--- src/usr.bin/ssh/auth2-passwd.c	2002/05/31 11:35:15	1.2
+++ src/usr.bin/ssh/auth2-passwd.c	2004/03/04 18:18:15	1.2.8.2
@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth2-passwd.c,v 1.2 2002/05/31 11:35:15 markus Exp $");
+RCSID("$OpenBSD: auth2-passwd.c,v 1.2.8.2 2004/03/04 18:18:15 brad Exp $");
 
 #include "xmalloc.h"
 #include "packet.h"
@@ -38,17 +38,24 @@
 static int
 userauth_passwd(Authctxt *authctxt)
 {
-	char *password;
+	char *password, *newpass;
 	int authenticated = 0;
 	int change;
-	u_int len;
+	u_int len, newlen;
+
 	change = packet_get_char();
-	if (change)
-		log("password change not supported");
 	password = packet_get_string(&len);
+	if (change) {
+		/* discard new password from packet */
+		newpass = packet_get_string(&newlen);
+		memset(newpass, 0, newlen);
+		xfree(newpass);
+	}
 	packet_check_eom();
-	if (authctxt->valid &&
-	    PRIVSEP(auth_password(authctxt, password)) == 1)
+
+	if (change)
+		logit("password change not supported");
+	else if (PRIVSEP(auth_password(authctxt, password)) == 1)
 		authenticated = 1;
 	memset(password, 0, len);
 	xfree(password);