emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity

* libmisc/salt.c: Make sure the salt string is terminated at the

Browse Source 
right place (either 8th, or 11th position).
 * NEWS, src/chgpasswd.c, src/chpasswd.c: The protocol + salt does
   not need 15 chars. No need for a temporary buffer.
   This change the fix committed on 2007-11-10. The salt provided to
   pw_encrypt could have been too long.
This commit is contained in:
nekral-guest 2007-11-16 19:02:00 +00:00
parent e163c5fe9c
commit 449f17385a
5 changed files with 30 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -1,3 +1,12 @@
2007-11-10 Nicolas François <nicolas.francois@centraliens.net>
* libmisc/salt.c: Make sure the salt string is terminated at the
right place (either 8th, or 11th position).
* NEWS, src/chgpasswd.c, src/chpasswd.c: The protocol + salt does
not need 15 chars. No need for a temporary buffer.
This change the fix committed on 2007-11-10. The salt provided to
pw_encrypt could have been too long.
2007-11-16 Nicolas François <nicolas.francois@centraliens.net> 2007-11-16 Nicolas François <nicolas.francois@centraliens.net>
* man/fr/fr.po: Fix typo: missing / in <placeholder-1/>. This * man/fr/fr.po: Fix typo: missing / in <placeholder-1/>. This

3
NEWS
View File

@ -7,7 +7,8 @@ shadow-4.0.18.1 -> shadow-4.0.18.2 UNRELEASED
useradd's -g option. Applied Debian patch 397_non_numerical_identifier. useradd's -g option. Applied Debian patch 397_non_numerical_identifier.
Thanks also to Greg Schafer <gschafer@zip.com.au>. Thanks also to Greg Schafer <gschafer@zip.com.au>.
- chgpasswd, chpasswd: Fix chpasswd and chgpasswd stack overflow. Based on - chgpasswd, chpasswd: Fix chpasswd and chgpasswd stack overflow. Based on
Fedora's shadow-4.0.18.1-overflow.patch. the Fedora's shadow-4.0.18.1-overflow.patch and Debian's
495_salt_stack_smash patches.
- newgrp: Don't ask for a password if there are no group passwords. Just - newgrp: Don't ask for a password if there are no group passwords. Just
directly give up. directly give up.
- The permissions of the suid binaries is now configurable in - The permissions of the suid binaries is now configurable in

6
libmisc/salt.c
View File

@ -62,11 +62,13 @@ char *crypt_make_salt (void)
{ {
struct timeval tv; struct timeval tv;
static char result[40]; static char result[40];
int max_salt_len = 8;
result[0] = '\0'; result[0] = '\0';
#ifndef USE_PAM #ifndef USE_PAM
if (getdef_bool ("MD5_CRYPT_ENAB")) { if (getdef_bool ("MD5_CRYPT_ENAB")) {
strcpy (result, "$1$"); /* magic for the new MD5 crypt() */ strcpy (result, "$1$"); /* magic for the new MD5 crypt() */
max_salt_len += 3;
} }
#endif #endif
@ -77,8 +79,8 @@ char *crypt_make_salt (void)
strcat (result, l64a (tv.tv_usec)); strcat (result, l64a (tv.tv_usec));
strcat (result, l64a (tv.tv_sec + getpid () + clock ())); strcat (result, l64a (tv.tv_sec + getpid () + clock ()));
if (strlen (result) > 3 + 8) /* magic+salt */ if (strlen (result) > max_salt_len) /* magic+salt */
result[11] = '\0'; result[max_salt_len] = '\0';
return result; return result;
} }

15
src/chgpasswd.c
View File

@ -243,14 +243,15 @@ int main (int argc, char **argv)
newpwd = cp; newpwd = cp;
if (!eflg) { if (!eflg) {
if (md5flg) { if (md5flg) {
char tmp[12]; char md5salt[12] = "$1$";
char salt[15] = ""; char *salt = crypt_make_salt ();
strcat (tmp, crypt_make_salt ()); if (strncmp (salt, "$1$", 3) == 0) {
if (!strncmp (tmp, "$1$", 3)) strncpy (md5salt, salt, 11);
strcat (salt, "$1$"); } else {
strcat (salt, tmp); strncat (md5salt, salt, 8);
cp = pw_encrypt (newpwd, salt); }
cp = pw_encrypt (newpwd, md5salt);
} else } else
cp = pw_encrypt (newpwd, crypt_make_salt ()); cp = pw_encrypt (newpwd, crypt_make_salt ());
} }

13
src/chpasswd.c
View File

@ -239,13 +239,14 @@ int main (int argc, char **argv)
newpwd = cp; newpwd = cp;
if (!eflg) { if (!eflg) {
if (md5flg) { if (md5flg) {
char tmp[12]; char md5salt[12] = "$1$";
char salt[15] = ""; char *salt = crypt_make_salt ();
strcat (tmp, crypt_make_salt ()); if (strncmp (salt, "$1$", 3) == 0) {
if (!strncmp (tmp, "$1$", 3)) strncpy (md5salt, salt, 11);
strcat (salt, "$1$"); } else {
strcat (salt, tmp); strncat (md5salt, salt, 8);
}
cp = pw_encrypt (newpwd, salt); cp = pw_encrypt (newpwd, salt);
} else } else
cp = pw_encrypt (newpwd, crypt_make_salt ()); cp = pw_encrypt (newpwd, crypt_make_salt ());