mirror of
https://github.com/Ponce/slackbuilds
synced 2024-11-24 10:02:29 +01:00
5e7435b792
Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/ NULL return) if the salt violates specifications. Additionally, on FIPS-140 enabled Linux systems, DES or MD5 encrypted passwords passed to crypt() fail with EPERM (w/ NULL return). Slackware-current has transitioned to glibc 2.17 and as you might be aware from reading my posts on LQ, I have dedicated time to fixing userland which does not adequately handle crypt() returns given the new behavior. gdm is negatively affected and my attached patch (against gdm 2.20.11) addresses this. This is in anticipation of a new Slackware release but can be applied to the SBo package for Slackware 14.0 since it is backwards compatible and should not affect behavior on glibc 2.15. It would be good if my assertion were tested. [rworkman] Yeah, it seems to work here :-) Signed-off-by: Robby Workman <rworkman@slackbuilds.org>
134 lines
3.5 KiB
Diff
134 lines
3.5 KiB
Diff
Correctly handle crypt() NULL returns when built against glibc 2.17+
|
|
|
|
Author: mancha
|
|
|
|
=======
|
|
|
|
--- gdm-2.20.11/daemon/verify-crypt.c.orig 2013-06-23
|
|
+++ gdm-2.20.11/daemon/verify-crypt.c 2013-06-23
|
|
@@ -104,7 +104,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
const char *username,
|
|
gboolean allow_retry)
|
|
{
|
|
- gchar *login, *passwd, *ppasswd;
|
|
+ gchar *login, *passwd, *ppasswd, *cpasswd;
|
|
struct passwd *pwent;
|
|
#if defined (HAVE_PASSWDEXPIRED) && defined (HAVE_CHPASS) \
|
|
|| defined (HAVE_LOGINRESTRICTIONS)
|
|
@@ -190,8 +190,10 @@ gdm_verify_user (GdmDisplay *d,
|
|
}
|
|
|
|
/* Check whether password is valid */
|
|
- if (ppasswd == NULL || (ppasswd[0] != '\0' &&
|
|
- strcmp (crypt (passwd, ppasswd), ppasswd) != 0)) {
|
|
+ cpasswd = ppasswd ? crypt (passwd, ppasswd) : NULL;
|
|
+ if (ppasswd == NULL || cpasswd == NULL ||
|
|
+ (ppasswd[0] != '\0' &&
|
|
+ strcmp (cpasswd, ppasswd) != 0)) {
|
|
gdm_sleep_no_signal (gdm_daemon_config_get_value_int (GDM_KEY_RETRY_DELAY));
|
|
gdm_debug ("Couldn't authenticate user");
|
|
|
|
@@ -200,6 +202,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
g_free (login);
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -217,6 +220,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
g_free (login);
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -233,6 +237,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
g_free (login);
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
if (message != NULL)
|
|
free (message);
|
|
return NULL;
|
|
@@ -259,6 +264,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
g_free (login);
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -266,6 +272,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
|
|
if ( ! gdm_slave_check_user_wants_to_log_in (login)) {
|
|
g_free (login);
|
|
--- gdm-2.20.11/daemon/verify-shadow.c.orig 2013-06-23
|
|
+++ gdm-2.20.11/daemon/verify-shadow.c 2013-06-23
|
|
@@ -105,7 +105,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
const char *username,
|
|
gboolean allow_retry)
|
|
{
|
|
- gchar *login, *passwd, *ppasswd;
|
|
+ gchar *login, *passwd, *ppasswd, *cpasswd;
|
|
struct passwd *pwent;
|
|
struct spwd *sp;
|
|
#if defined (HAVE_PASSWDEXPIRED) && defined (HAVE_CHPASS) \
|
|
@@ -211,8 +211,10 @@ gdm_verify_user (GdmDisplay *d,
|
|
}
|
|
|
|
/* Check whether password is valid */
|
|
- if (ppasswd == NULL || (ppasswd[0] != '\0' &&
|
|
- strcmp (crypt (passwd, ppasswd), ppasswd) != 0)) {
|
|
+ cpasswd = ppasswd ? crypt (passwd, ppasswd) : NULL;
|
|
+ if (ppasswd == NULL || cpasswd == NULL ||
|
|
+ (ppasswd[0] != '\0' &&
|
|
+ strcmp (cpasswd, ppasswd) != 0)) {
|
|
gdm_sleep_no_signal (gdm_daemon_config_get_value_int (GDM_KEY_RETRY_DELAY));
|
|
gdm_debug ("Couldn't authenticate user");
|
|
|
|
@@ -221,6 +223,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
g_free (login);
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -238,6 +241,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
g_free (login);
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -254,6 +258,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
g_free (login);
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
if (message != NULL)
|
|
free (message);
|
|
return NULL;
|
|
@@ -280,6 +285,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
g_free (login);
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -287,6 +293,7 @@ gdm_verify_user (GdmDisplay *d,
|
|
|
|
g_free (passwd);
|
|
g_free (ppasswd);
|
|
+ g_free (cpasswd);
|
|
|
|
if ( ! gdm_slave_check_user_wants_to_log_in (login)) {
|
|
g_free (login);
|