1 From 0626e86d2e1d0be63a56918371a15d98cfad19d1 Mon Sep 17 00:00:00 2001
2 From: mancha <mancha1@hush.com>
4 Subject: [PATCH] Handle NULL returns from glibc 2.17+ crypt().
6 Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL
7 (w/ NULL return) if the salt violates specifications. Additionally,
8 on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords
9 passed to crypt() fail with EPERM (w/ NULL return).
11 When using glibc's crypt(), check return value to avoid a possible
12 NULL pointer dereference.
14 pwcheck/pwcheck_getpwnam.c | 3 ++-
15 pwcheck/pwcheck_getspnam.c | 3 ++-
16 saslauthd/auth_getpwent.c | 3 ++-
17 saslauthd/auth_shadow.c | 7 ++-----
18 4 files changed, 8 insertions(+), 8 deletions(-)
20 --- a/pwcheck/pwcheck_getpwnam.c
21 +++ b/pwcheck/pwcheck_getpwnam.c
22 @@ -32,6 +32,7 @@ extern char *crypt();
29 pwd = getpwnam(userid);
30 @@ -41,7 +42,7 @@ char *password;
31 else if (pwd->pw_passwd[0] == '*') {
32 r = "Account disabled";
34 - else if (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0) {
35 + else if (!(crpt_passwd = crypt(password, pwd->pw_passwd)) || strcmp(pwd->pw_passwd, (const char *)crpt_passwd) != 0) {
36 r = "Incorrect password";
39 --- a/pwcheck/pwcheck_getspnam.c
40 +++ b/pwcheck/pwcheck_getspnam.c
41 @@ -30,6 +30,7 @@ extern char *crypt();
42 char *pwcheck(userid, password)
49 @@ -38,7 +39,7 @@ char *password;
50 return "Userid not found";
53 - if (strcmp(pwd->sp_pwdp, crypt(password, pwd->sp_pwdp)) != 0) {
54 + if (!(crpt_passwd = crypt(password, pwd->sp_pwdp)) || strcmp(pwd->sp_pwdp, (const char *)crpt_passwd) != 0) {
55 return "Incorrect password";
58 --- a/saslauthd/auth_getpwent.c
59 +++ b/saslauthd/auth_getpwent.c
60 @@ -77,6 +77,7 @@ auth_getpwent (
63 struct passwd *pw; /* pointer to passwd file entry */
64 + char *crpt_passwd; /* encrypted password */
68 @@ -105,7 +106,7 @@ auth_getpwent (
72 - if (strcmp(pw->pw_passwd, (const char *)crypt(password, pw->pw_passwd))) {
73 + if (!(crpt_passwd = crypt(password, pw->pw_passwd)) || strcmp(pw->pw_passwd, (const char *)crpt_passwd)) {
74 if (flags & VERBOSE) {
75 syslog(LOG_DEBUG, "DEBUG: auth_getpwent: %s: invalid password", login);
77 --- a/saslauthd/auth_shadow.c
78 +++ b/saslauthd/auth_shadow.c
79 @@ -210,8 +210,7 @@ auth_shadow (
80 RETURN("NO Insufficient permission to access NIS authentication database (saslauthd)");
83 - cpw = strdup((const char *)crypt(password, sp->sp_pwdp));
84 - if (strcmp(sp->sp_pwdp, cpw)) {
85 + if (!(cpw = crypt(password, sp->sp_pwdp)) || strcmp(sp->sp_pwdp, (const char *)cpw)) {
86 if (flags & VERBOSE) {
88 * This _should_ reveal the SHADOW_PW_LOCKED prefix to an
89 @@ -221,10 +220,8 @@ auth_shadow (
90 syslog(LOG_DEBUG, "DEBUG: auth_shadow: pw mismatch: '%s' != '%s'",
94 RETURN("NO Incorrect password");
99 * The following fields will be set to -1 if:
100 @@ -286,7 +283,7 @@ auth_shadow (
101 RETURN("NO Invalid username");
104 - if (strcmp(upw->upw_passwd, crypt(password, upw->upw_passwd)) != 0) {
105 + if (!(cpw = crypt(password, upw->upw_passwd)) || (strcmp(upw->upw_passwd, (const char *)cpw) != 0)) {
106 if (flags & VERBOSE) {
107 syslog(LOG_DEBUG, "auth_shadow: pw mismatch: %s != %s",
108 password, upw->upw_passwd);