--- oath-toolkit-2.4.0/liboath/usersfile.c.orig 2013-12-21 18:24:55.000000000 +0200 +++ oath-toolkit-2.4.0/liboath/usersfile.c 2013-12-21 19:51:03.000000000 +0200 @@ -251,24 +251,23 @@ char *origline; const char *user, *type, *passwd, *secret; int r; + unsigned digits, totpstepsize; origline = strdup (*lineptr); type = strtok_r (*lineptr, whitespace, &saveptr); if (type == NULL) - continue; + goto skip_line; + + /* Read token type */ + if (parse_type (type, &digits, &totpstepsize) != 0) + goto skip_line; /* Read username */ user = strtok_r (NULL, whitespace, &saveptr); if (user == NULL || strcmp (user, username) != 0 || got_users++ != skipped_users) - { - r = fprintf (outfh, "%s", origline); - free (origline); - if (r <= 0) - return OATH_PRINTF_ERROR; - continue; - } + goto skip_line; passwd = strtok_r (NULL, whitespace, &saveptr); if (passwd == NULL) @@ -284,6 +283,14 @@ free (origline); if (r <= 0) return OATH_PRINTF_ERROR; + continue; + + skip_line: + r = fprintf (outfh, "%s", origline); + free (origline); + if (r <= 0) + return OATH_PRINTF_ERROR; + continue; } return OATH_OK;