bugConcurrent Versions System - Bugs: bug #39040, Fix potential NULL pointer...

 
 

bug #39040: Fix potential NULL pointer dereference with glibc 2.17+

Submitted by:  mancha <mancha>
Submitted on:  Wed 22 May 2013 03:17:21 PM UTC  
 
Category: Bug Fix (patch attached)Severity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: OpenRelease: 
Fixed Release: NoneFixed Feature Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 23 May 2013 04:32:24 PM UTC, comment #2:

Indeed, thanks. Revised patch attached.

(file #28149)

mancha <mancha>
Thu 23 May 2013 11:12:17 AM UTC, comment #1:

@@ -5632,9 +5633,11 @@ check_repository_password (username, pas
host_user_tmp = username;

/* Verify blank passwords directly, otherwise use crypt(). */
+ crypt_passwd = crypt (password, found_password);

Do you think calling crypt(, NULL) is wise? Documentation does not describe behavior in this case. I would prefer guard this call with (found_password != NULL) condition.

if ((found_password == NULL)
- || ((strcmp (found_password, crypt (password, found_password))
- == 0)))
+ || (crypt_passwd != NULL
+ && (strcmp (found_password, crypt (password, found_password))
+ == 0)))

Here you can replace the crypt() call with already computed crypt_passwd value.

Petr Pisar <petrp>
Wed 22 May 2013 03:17:21 PM UTC, original submission:

Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/ NULL return) if the salt violates specifications. Additionally, on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords passed to crypt() fail with EPERM (w/ NULL return).

This change can potentially cause a NULL pointer dereference in cvs after calling crypt() for password verification.

Attached patch, against cvs 1.11.23, fixes.

--mancha

mancha <mancha>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #28149:  cvs-1.11.23-crypt-2.diff added by mancha (2KiB - application/octet-stream - revised patch)
file #28140:  cvs-1.11.23-crypt.diff added by mancha (2KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by petrp (Posted a comment)
  • -unavailable- added by mancha (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 23 May 2013 04:32:24 PM UTCmanchaAttached File-=>Added cvs-1.11.23-crypt-2.diff, #28149
    Wed 22 May 2013 03:17:21 PM UTCmanchaAttached File-=>Added cvs-1.11.23-crypt.diff, #28140

    Back to the top


    Powered by Savane 3.1-cleanup1