Successfully authenticating with PAM may lead to a double free() crash

[foxcpp]

Note: Technically, auth.pam and auth.shadow are not usable since 0.1 since authentication was changed to be keyed on email addresses. 0.5 will unbreak these modules by adding auth_map directive for imapsql.

Description

When auth.pam module is used without a helper executable (maddy is compiled with "libpam" build tag) - a double free() crash can occur after successful authentication in some scenarios (see below).

Steps to reproduce

I managed to find this issue while testing what is realistically an invalid configuration: Authentication with pam_unix.so with the credentials of user server is running under. Running maddy as root seems to fix that issue (which is also how it is intended to be used in this case).

However, it is unknown whether the same bug can manifest itself in other PAM configurations e.g. pam_ldap or something.

Environment information

maddy commit baccd561aed7e301539cf92099c3c39e761a6219. linux/amd64 go1.15.2