Re: chpasswd stack overflow

--MP_QF+5ShIYh.SFx/tZxASwR3r
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


proposed patch


On Tue, 7 Nov 2006 14:55:06 +0100
Peter Vrabec <[email protected]> wrote:

> Hi Tomasz,
> 
> 
> the strcat is overflowing salt in chpasswd.c and chgpasswd.c:
> ....
>  if (!eflg) {
>                         if (md5flg) {
>                                 char salt[12] = "$1$";
> 
>                                 strcat (salt, crypt_make_salt ());
>                                 cp = pw_encrypt (newpwd, salt);
>                         } else
>                                 cp = pw_encrypt (newpwd,
> 				crypt_make_salt ());
>                 }
> .....
> 
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=213052
> _______________________________________________
> shadow mailing list
> [email protected]
> http://mail.pld.org.pl/mailman/listinfo/shadow

--MP_QF+5ShIYh.SFx/tZxASwR3r
Content-Type: text/x-patch; name=shadow-4.0.17-overflow.patch
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename=shadow-4.0.17-overflow.patch

--- shadow-4.0.17/src/chpasswd.c.overflow	2006-11-08 11:09:32.000000000 +0100
+++ shadow-4.0.17/src/chpasswd.c	2006-11-08 13:13:15.000000000 +0100
@@ -239,9 +239,13 @@
 		newpwd = cp;
 		if (!eflg) {
 			if (md5flg) {
-				char salt[12] = "$1$";
+				char tmp[12];
+				char salt[15] = "\0";
 
-				strcat (salt, crypt_make_salt ());
+				strcpy( tmp, crypt_make_salt ());
+				if( !strncmp( tmp, "$1$", 3) )
+					strcat( salt, "$1$");
+				strcat( salt, tmp);
 				cp = pw_encrypt (newpwd, salt);
 			} else
 				cp = pw_encrypt (newpwd, crypt_make_salt ());
--- shadow-4.0.17/src/chgpasswd.c.overflow	2006-11-08 13:13:40.000000000 +0100
+++ shadow-4.0.17/src/chgpasswd.c	2006-11-08 13:17:24.000000000 +0100
@@ -243,9 +243,13 @@
 		newpwd = cp;
 		if (!eflg) {
 			if (md5flg) {
-				char salt[12] = "$1$";
+				char tmp[12];
+				char salt[15] = "\0";
 
-				strcat (salt, crypt_make_salt ());
+				strcpy( tmp, crypt_make_salt ());
+				if( !strncmp( tmp, "$1$", 3) )
+					strcat( salt, "$1$");
+				strcat( salt, tmp);
 				cp = pw_encrypt (newpwd, salt);
 			} else
 				cp = pw_encrypt (newpwd, crypt_make_salt ());

--MP_QF+5ShIYh.SFx/tZxASwR3r
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline