]> git.ipfire.org Git - thirdparty/dovecot/core.git/commitdiff
auth: crypt_verify_blowfish() - Check $2 prefix without str_begins()
authorTimo Sirainen <timo.sirainen@open-xchange.com>
Thu, 14 Oct 2021 21:48:41 +0000 (23:48 +0200)
committertimo.sirainen <timo.sirainen@open-xchange.com>
Wed, 23 Mar 2022 10:25:06 +0000 (10:25 +0000)
Although str_begins() works as well, it's a bit inconsistent looking here.

src/auth/password-scheme-crypt.c

index d00d0bde92ec9ec4616fab198c879535733d441d..4abc8bfbd58ff72c7c6de07bb784de2ec7329e09 100644 (file)
@@ -78,7 +78,7 @@ crypt_verify_blowfish(const char *plaintext, const struct password_generate_para
        password = t_strndup(raw_password, size);
 
        if (size < CRYPT_BLF_PREFIX_LEN ||
-           !str_begins(password, "$2") ||
+           password[0] != '$' || password[1] != '2' ||
            password[2] < 'a' || password[2] > 'z' ||
            password[3] != '$') {
                *error_r = "Password is not blowfish password";