mirrors/linux-pam
0
0
Fork 0
mirror of https://github.com/linux-pam/linux-pam.git synced 2024-11-24 10:22:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

Relevant BUGIDs: 484252

Browse Source 
Purpose of commit: bugfix

Commit summary:
---------------
pam_userdb was not paying close enough attention to password comparisons.
Bug report and fix from Vladimir Pastukhov.
This commit is contained in:
Andrew G. Morgan 2001-11-26 03:27:40 +00:00
parent 6d8f508fe9
commit 820ef4f92f
2 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGELOG
View File

@ -49,8 +49,10 @@ bug report - outstanding bugs are listed here:
0.76: please submit patches for this section with actual code/doc
patches!
* pam_userdb: require that all of typed password matches that in
database report and fix from Vladimir Pastukhov. (Bug 484252 - agmorgan)
* pam_malloc: revived malloc debugging code, now tied to
--enable-memory-debug and added strdup() (Bug 485454 - agmorgan)
--enable-memory-debug and added strdup() support (Bug 485454 - agmorgan)
* pam_tally: Nalin's fix for lastlog corruption (Bug 476985 - agmorgan)
* pam_rhosts: Nalin adds support for '+hostname', and zdd fix
compilation warning. (Bug 476986 - agmorgan)

13
modules/pam_userdb/pam_userdb.c
View File

@ -138,11 +138,14 @@ static int user_lookup(const char *user, const char *pass)
if (data.dptr != NULL) {
int compare = 0;
/* bingo, got it */
if (ctrl & PAM_ICASE_ARG)
compare = strncasecmp(pass, data.dptr, data.dsize);
else
compare = strncmp(pass, data.dptr, data.dsize);
if (strlen(pass) != data.dsize) {
compare = 1;
} else if (ctrl & PAM_ICASE_ARG) {
compare = strncasecmp(data.dptr, pass, data.dsize);
} else {
compare = strncmp(data.dptr, pass, data.dsize);
}
dbm_close(dbm);
if (compare == 0)
return 0; /* match */