From: Kurt Zeilenga <kurt@openldap.org>
Date: Wed, 2 Jun 2004 20:20:02 +0000 (+0000)
Subject: ITS#3169: fix safety checks to allow for varying salt lengths
X-Git-Tag: OPENDLAP_REL_ENG_2_2_MP~302
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=8b5c9a764c1eae70685b6fe60d7b11bd75b048c5;p=openldap

ITS#3169: fix safety checks to allow for varying salt lengths
---

diff --git a/libraries/liblutil/passwd.c b/libraries/liblutil/passwd.c
index 7f133a8367..3ce1ae9757 100644
--- a/libraries/liblutil/passwd.c
+++ b/libraries/liblutil/passwd.c
@@ -459,9 +459,8 @@ static int chk_ssha1(
 	int rc;
 	unsigned char *orig_pass = NULL;
 
-	/* safety check */
-	if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) <
-		sizeof(SHA1digest)+SALT_SIZE) {
+	/* safety check -- must have some salt */
+	if (LUTIL_BASE64_DECODE_LEN(passwd->bv_len) <= sizeof(SHA1digest)) {
 		return LUTIL_PASSWD_ERR;
 	}
 
@@ -473,7 +472,8 @@ static int chk_ssha1(
 
 	rc = lutil_b64_pton(passwd->bv_val, orig_pass, passwd->bv_len);
 
-	if (rc < (int)(sizeof(SHA1digest)+SALT_SIZE)) {
+	/* safety check -- must have some salt */
+	if (rc <= (int)(sizeof(SHA1digest))) {
 		ber_memfree(orig_pass);
 		return LUTIL_PASSWD_ERR;
 	}