basic_getpwnam_auth: fail authentication on crypt() failures

... instead of crashing the helper.

"
Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL (w/
NULL return) if the salt violates specifications. Additionally, on
FIPS-140 enabled Linux systems, DES or MD5 encrypted passwords passed to
crypt() fail with EPERM (w/ NULL return).
"

diff --git a/helpers/basic_auth/getpwnam/basic_getpwnam_auth.cc b/helpers/basic_auth/getpwnam/basic_getpwnam_auth.cc
index cc879cf3892ee210b54353bff17be1a8b8427b8d..aa8e5fee85f94d7fa0897b1feffcb179950a8222 100644 (file)
--- a/helpers/basic_auth/getpwnam/basic_getpwnam_auth.cc
+++ b/helpers/basic_auth/getpwnam/basic_getpwnam_auth.cc
@@ -59,7 +59,8 @@ passwd_auth(char *user, char *passwd)
     if (pwd == NULL) {
         return 0;       /* User does not exist */
     } else {
-        if (strcmp(pwd->pw_passwd, (char *) crypt(passwd, pwd->pw_passwd))) {
+        char *crypted = crypt(passwd, pwd->pw_passwd);
+        if (!crypted || strcmp(pwd->pw_passwd, crypted)) {
             return 2;       /* Wrong password */
         } else {
             return 1;       /* Authentication Sucessful */
@@ -76,7 +77,8 @@ shadow_auth(char *user, char *passwd)
     if (pwd == NULL) {
         return passwd_auth(user, passwd);   /* Fall back to passwd_auth */
     } else {
-        if (strcmp(pwd->sp_pwdp, crypt(passwd, pwd->sp_pwdp))) {
+        char *crypted = crypt(passwd, pwd->sp_pwdp);
+        if (!crypted || strcmp(pwd->sp_pwdp, crypted)) {
             return 2;       /* Wrong password */
         } else {
             return 1;       /* Authentication Sucessful */