[svn:qpsmtpd] r633 - branches/0.3x/lib/Qpsmtpd

Author: jpeacock
Date: Fri Apr  7 12:21:10 2006
New Revision: 633

Modified:
   branches/0.3x/lib/Qpsmtpd/Auth.pm

Log:
Resolve ticket #38806 (Inadequate validation of authentication data) 
Charlie Brady.

Modified: branches/0.3x/lib/Qpsmtpd/Auth.pm
==============================================================================
--- branches/0.3x/lib/Qpsmtpd/Auth.pm	(original)
+++ branches/0.3x/lib/Qpsmtpd/Auth.pm	Fri Apr  7 12:21:10 2006
@@ -27,11 +27,21 @@
         ( $passHash, $user, $passClear ) = split /\x0/,
           decode_base64($prekey);
 
+        unless ($user && $passClear) {
+          $session->respond(504, "Invalid authentification string");
+          return DECLINED;
+        }
     }
     elsif ($mechanism eq "login") {
 
         if ( $prekey ) {
-          ($passHash, $user, $passClear) = split /\x0/, decode_base64($prekey);
+          ( $passHash, $user, $passClear ) = split /\x0/,
+	    decode_base64($prekey);
+
+          unless ($user && $passClear) {
+            $session->respond(504, "Invalid authentification string");
+            return DECLINED;
+          }
         }
         else {