From 4ba74a357376c8f8bf49487f96ae71cf2460c3f3 Mon Sep 17 00:00:00 2001
From: Alexandre Oliva <aoliva@redhat.com>
Date: Wed, 10 Oct 2012 07:05:10 -0300
Subject: * crypt/crypt-private.h: Include stdbool.h. (_ufc_setup_salt_r):
 Return bool. * crypt/crypt-entry.c: Include errno.h. (__crypt_r): Return NULL
 with EINVAL for bad salt. * crypt/crypt_util.c (bad_for_salt): New.
 (_ufc_setup_salt_r): Check that salt is long enough and within the specified
 alphabet. * crypt/badsalttest.c: New file. * crypt/Makefile (tests): Add it.
 ($(objpfx)badsalttest): New.

---
 crypt/crypt_util.c | 42 ++++++++++++++++++++++++++++++++++++++----
 1 file changed, 38 insertions(+), 4 deletions(-)

(limited to 'crypt/crypt_util.c')

diff --git a/crypt/crypt_util.c b/crypt/crypt_util.c
index a1ff88b0da..e08dd8fa99 100644
--- a/crypt/crypt_util.c
+++ b/crypt/crypt_util.c
@@ -595,24 +595,56 @@ shuffle_sb(k, saltbits)
 }
 #endif
 
+/*
+ * Return false iff C is in the specified alphabet for crypt salt.
+ */
+
+static bool
+bad_for_salt (char c)
+{
+  switch (c)
+    {
+    case '0' ... '9':
+    case 'A' ... 'Z':
+    case 'a' ... 'z':
+    case '.': case '/':
+      return false;
+
+    default:
+      return true;
+    }
+}
+
 /*
  * Setup the unit for a new salt
  * Hopefully we'll not see a new salt in each crypt call.
+ * Return false if an unexpected character was found in s[0] or s[1].
  */
 
-void
+bool
 _ufc_setup_salt_r(s, __data)
      const char *s;
      struct crypt_data * __restrict __data;
 {
   ufc_long i, j, saltbits;
+  char s0, s1;
 
   if(__data->initialized == 0)
     __init_des_r(__data);
 
-  if(s[0] == __data->current_salt[0] && s[1] == __data->current_salt[1])
-    return;
-  __data->current_salt[0] = s[0]; __data->current_salt[1] = s[1];
+  s0 = s[0];
+  if(bad_for_salt (s0))
+    return false;
+
+  s1 = s[1];
+  if(bad_for_salt (s1))
+    return false;
+
+  if(s0 == __data->current_salt[0] && s1 == __data->current_salt[1])
+    return true;
+
+  __data->current_salt[0] = s0;
+  __data->current_salt[1] = s1;
 
   /*
    * This is the only crypt change to DES:
@@ -646,6 +678,8 @@ _ufc_setup_salt_r(s, __data)
   shuffle_sb((LONGG)__data->sb3, __data->current_saltbits ^ saltbits);
 
   __data->current_saltbits = saltbits;
+
+  return true;
 }
 
 void
-- 
cgit 1.4.1