BUG/MEDIUM: auth: fix segfault with http-auth and a configuration with an unknown...

Grégoire Morpain reported a segfault when a secured password is used for http
authentication. It was caused by the use of an unsupported encryption algorithm
with libcrypto. In this case, crypt() returns a NULL pointer.

The fix should be backported to 1.4 and 1.5.

diff --git a/src/auth.c b/src/auth.c
index 1069c5b76b286db782d0265bcfe0ba642ac91941..42c08083e3f0f9f4d0a72b7ef89fd5d681e22aa1 100644 (file)
--- a/src/auth.c
+++ b/src/auth.c
@@ -252,7 +252,7 @@ check_user(struct userlist *ul, const char *user, const char *pass)
        fprintf(stderr, ", crypt=%s\n", ep);
 #endif
 
-       if (!strcmp(ep, u->pass))
+       if (ep && strcmp(ep, u->pass) == 0)
                return 1;
        else
                return 0;