--- libpam-krb5-2.2.orig/prompting.c	2006-08-29 01:34:30.000000000 +0200
+++ libpam-krb5-2.2/prompting.c	2006-09-03 02:10:56.000000000 +0200
@@ -51,7 +51,7 @@
     int pam_prompts = num_prompts;
     int pamret, i;
     int retval = KRB5KRB_ERR_GENERIC;
-    struct pam_message *msg;
+    struct pam_message **msg;
     struct pam_response *resp = NULL;
     struct pam_conv *conv;
     pam_handle_t *pamh = (pam_handle_t *) data;
@@ -67,41 +67,52 @@
     if (banner != NULL)
         pam_prompts++;
 
-    /* Allocate memory to copy all of the prompts into a pam_message. */
-    msg = calloc(sizeof(struct pam_message) * pam_prompts, 1);
+    /* alocate pointers to pam_message structs, pam_prompts many */
+    msg = calloc(pam_prompts, sizeof(msg));
     if (msg == NULL)
         return ENOMEM;
 
+    /* allocate the pam_message structs, pam_prompts many  */
+
+    *msg=calloc(pam_prompts,sizeof(struct pam_message));
+
+    /* and point the pointers to these slots *
+     * (pointer 0 is already initialized)    */
+
+    for (i = 1; i < pam_prompts; i++) {
+        msg[i]=msg[0]+i;
+    }
+
     /* From this point on, pam_prompts is an index into msg. */
     pam_prompts = 0;
     if (name != NULL) {
-       msg[pam_prompts].msg = malloc(strlen(name) + 1);
-       if (msg[pam_prompts].msg == NULL)
+       msg[pam_prompts]->msg = malloc(strlen(name) + 1);
+       if (msg[pam_prompts]->msg == NULL)
            goto cleanup;
-       strcpy((char *) msg[pam_prompts].msg, name);
-       msg[pam_prompts].msg_style = PAM_TEXT_INFO;
+       strcpy((char *) msg[pam_prompts]->msg, name);
+       msg[pam_prompts]->msg_style = PAM_TEXT_INFO;
        pam_prompts++;
     }
     if (banner != NULL) {
-        msg[pam_prompts].msg = malloc(strlen(banner) + 1);
-        if (msg[pam_prompts].msg == NULL)
+        msg[pam_prompts]->msg = malloc(strlen(banner) + 1);
+        if (msg[pam_prompts]->msg == NULL)
             goto cleanup;
-        strcpy((char *) msg[pam_prompts].msg, banner);
-        msg[pam_prompts].msg_style = PAM_TEXT_INFO;
+        strcpy((char *) msg[pam_prompts]->msg, banner);
+        msg[pam_prompts]->msg_style = PAM_TEXT_INFO;
         pam_prompts++;
     }
     for (i = 0; i < num_prompts; i++) {
-        msg[pam_prompts].msg = malloc(strlen(prompts[i].prompt) + 3);
-        if (msg[pam_prompts].msg == NULL)
+        msg[pam_prompts]->msg = malloc(strlen(prompts[i].prompt) + 3);
+        if (msg[pam_prompts]->msg == NULL)
             goto cleanup;
-        sprintf((char *) msg[pam_prompts].msg, "%s: ", prompts[i].prompt);
-        msg[pam_prompts].msg_style = prompts[i].hidden ? PAM_PROMPT_ECHO_OFF
+        sprintf((char *) msg[pam_prompts]->msg, "%s: ", prompts[i].prompt);
+        msg[pam_prompts]->msg_style = prompts[i].hidden ? PAM_PROMPT_ECHO_OFF
                                                        : PAM_PROMPT_ECHO_ON;
         pam_prompts++;
     }
 
     /* Call into the application conversation function. */
-    pamret = conv->conv(pam_prompts, (const struct pam_message **) &msg, 
+    pamret = conv->conv(pam_prompts, (const struct pam_message **) msg, 
                         &resp, conv->appdata_ptr);
     if (pamret != 0) 
         goto cleanup;
@@ -139,9 +150,14 @@
 
 cleanup:
     for (i = 0; i < pam_prompts; i++) {
-        if (msg[i].msg != NULL)
-            free((char *) msg[i].msg);
+        if (msg[i]->msg != NULL)
+            free((char *) msg[i]->msg);
     }
+
+    /* free the pam_message structs */
+    free(*msg);
+
+    /* free the corresponding pointers */
     free(msg);
 
     /*