diff --git a/ChangeLog b/ChangeLog index b1e39234..e7ed71c9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2007-11-20 Nicolas François + + * src/passwd.c: Increase the size of crypt_passwd from 128 to 256 + to avoid overflow in case of SHA512 (161 should be sufficient). + 2007-11-20 Nicolas François * lib/prototypes.h, libmisc/salt.c: Add parameters to diff --git a/src/passwd.c b/src/passwd.c index 0c349aab..592fc4a3 100644 --- a/src/passwd.c +++ b/src/passwd.c @@ -96,7 +96,20 @@ static long inact = 0; /* Days without change before locked */ static int do_update_age = 0; #ifndef USE_PAM -static char crypt_passwd[128]; /* The "old-style" password, if present */ +/* + * Size of the biggest passwd: + * $6$ 3 + * rounds= 7 + * 999999999 9 + * $ 1 + * salt 16 + * $ 1 + * SHA512 123 + * nul 1 + * + * total 161 + */ +static char crypt_passwd[256]; static int do_update_pwd = 0; #endif