New upstream version 1.3.0

1 files changed, 41 insertions, 11 deletions

diff --git a/modules/pam_unix/passverify.c b/modules/pam_unix/passverify.c
index 4840bb2d..5d6a1484 100644
--- a/modules/pam_unix/passverify.c
+++ b/modules/pam_unix/passverify.c
@@ -31,7 +31,7 @@
 
 #ifdef WITH_SELINUX
 #include <selinux/selinux.h>
-#define SELINUX_ENABLED is_selinux_enabled()>0
+#define SELINUX_ENABLED (is_selinux_enabled()>0)
 #else
 #define SELINUX_ENABLED 0
 #endif
@@ -377,6 +377,9 @@ PAMH_ARG_DECL(char * create_password_hash,
 	const char *algoid;
 	char salt[64]; /* contains rounds number + max 16 bytes of salt + algo id */
 	char *sp;
+#ifdef HAVE_CRYPT_R
+	struct crypt_data *cdata = NULL;
+#endif
 
 	if (on(UNIX_MD5_PASS, ctrl)) {
 		/* algoid = "$1" */
@@ -414,16 +417,22 @@ PAMH_ARG_DECL(char * create_password_hash,
 #endif
 		sp = stpcpy(salt, algoid);
 		if (on(UNIX_ALGO_ROUNDS, ctrl)) {
-			sp += snprintf(sp, sizeof(salt) - 3, "rounds=%u$", rounds);
+			sp += snprintf(sp, sizeof(salt) - (16 + 1 + (sp - salt)), "rounds=%u$", rounds);
 		}
-		crypt_make_salt(sp, 8);
-		/* For now be conservative so the resulting hashes
-		 * are not too long. 8 bytes of salt prevents dictionary
-		 * attacks well enough. */
+		crypt_make_salt(sp, 16);
 #ifdef HAVE_CRYPT_GENSALT_R
 	}
 #endif
+#ifdef HAVE_CRYPT_R
+	sp = NULL;
+	cdata = malloc(sizeof(*cdata));
+	if (cdata != NULL) {
+		cdata->initialized = 0;
+		sp = crypt_r(password, salt, cdata);
+	}
+#else
 	sp = crypt(password, salt);
+#endif
 	if (!sp || strncmp(algoid, sp, strlen(algoid)) != 0) {
 		/* libxcrypt/libc doesn't know the algorithm, use MD5 */
 		pam_syslog(pamh, LOG_ERR,
@@ -435,10 +444,16 @@ PAMH_ARG_DECL(char * create_password_hash,
 		if(sp) {
 		   memset(sp, '\0', strlen(sp));
 		}
+#ifdef HAVE_CRYPT_R
+		free(cdata);
+#endif
 		return crypt_md5_wrapper(password);
 	}
-
-	return x_strdup(sp);
+	sp = x_strdup(sp);
+#ifdef HAVE_CRYPT_R
+	free(cdata);
+#endif
+	return sp;
 }
 
 #ifdef WITH_SELINUX
@@ -639,11 +654,23 @@ save_old_password(pam_handle_t *pamh, const char *forwho, const char *oldpass,
 		continue;
 	    buf[strlen(buf) - 1] = '\0';
 	    s_luser = strtok_r(buf, ":", &sptr);
+	    if (s_luser == NULL) {
+		found = 0;
+		continue;
+	    }
 	    s_uid = strtok_r(NULL, ":", &sptr);
+	    if (s_uid == NULL) {
+		found = 0;
+		continue;
+	    }
 	    s_npas = strtok_r(NULL, ":", &sptr);
+	    if (s_npas == NULL) {
+		found = 0;
+		continue;
+	    }
 	    s_pas = strtok_r(NULL, ":", &sptr);
 	    npas = strtol(s_npas, NULL, 10) + 1;
-	    while (npas > howmany) {
+	    while (npas > howmany && s_pas != NULL) {
 		s_pas = strpbrk(s_pas, ",");
 		if (s_pas != NULL)
 		    s_pas++;
@@ -931,7 +958,7 @@ PAMH_ARG_DECL(int unix_update_shadow,
     fclose(opwfile);
 
     if (!wroteentry && !err) {
-	spwdent.sp_namp = forwho;
+	spwdent.sp_namp = (char *)forwho;
 	spwdent.sp_pwdp = towhat;
 	spwdent.sp_lstchg = time(NULL) / (60 * 60 * 24);
 	if (spwdent.sp_lstchg == 0)
@@ -1085,12 +1112,15 @@ getuidname(uid_t uid)
 int
 read_passwords(int fd, int npass, char **passwords)
 {
+        /* The passwords array must contain npass preallocated
+         * buffers of length MAXPASS + 1
+         */
         int rbytes = 0;
         int offset = 0;
         int i = 0;
         char *pptr;
         while (npass > 0) {
-                rbytes = read(fd, passwords[i]+offset, MAXPASS-offset);
+                rbytes = read(fd, passwords[i]+offset, MAXPASS+1-offset);
 
                 if (rbytes < 0) {
                         if (errno == EINTR) continue;