bugConcurrent Versions System - Bugs: bug #39040, Fix potential NULL pointer...


bug #39040: Fix potential NULL pointer dereference with glibc 2.17+

Submitter:  mancha <mancha>
Submitted:  Wed 22 May 2013 03:17:21 PM UTC
Category:  Bug Fix (patch attached) Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release: 
Fixed Release:  None Fixed Feature Release:  None
* Mandatory Fields

Add a New Comment Rich Markup

Thu 23 May 2013 04:32:24 PM UTC, comment #2: 

Indeed, thanks. Revised patch attached.

(file #28149)

mancha <mancha>
Thu 23 May 2013 11:12:17 AM UTC, comment #1: 

@@ -5632,9 +5633,11 @@ check_repository_password (username, pas
        host_user_tmp = username;

    /* Verify blank passwords directly, otherwise use crypt(). */
+   crypt_passwd = crypt (password, found_password);

Do you think calling crypt(, NULL) is wise? Documentation does not describe behavior in this case. I would prefer guard this call with (found_password != NULL) condition.

    if ((found_password == NULL)
-       || ((strcmp (found_password, crypt (password, found_password))
-        == 0)))
+       || (crypt_passwd != NULL
+               && (strcmp (found_password, crypt (password, found_password))
+           == 0)))

Here you can replace the crypt() call with already computed crypt_passwd value.

Petr Pisar <petrp>
Wed 22 May 2013 03:17:21 PM UTC, original submission:  

Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/ NULL return) if the salt violates specifications. Additionally, on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords passed to crypt() fail with EPERM (w/ NULL return).

This change can potentially cause a NULL pointer dereference in cvs after calling crypt() for password verification.

Attached patch, against cvs 1.11.23, fixes.


mancha <mancha>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #28149:  cvs-1.11.23-crypt-2.diff added by mancha (2KiB - application/octet-stream - revised patch)
file #28140:  cvs-1.11.23-crypt.diff added by mancha (2KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by petrp (Posted a comment)
  • -email is unavailable- added by mancha (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-05-23 mancha Attached File- Added cvs-1.11.23-crypt-2.diff, #28149
    2013-05-22 mancha Attached File- Added cvs-1.11.23-crypt.diff, #28140

    Back to the top

    Powered by Savane 3.13-f762.
    Corresponding source code