From: Timo Sirainen <timo.sirainen@dovecot.fi>
Date: Sat, 21 Apr 2018 12:47:23 +0000 (+0300)
Subject: auth: checkpassword - Fail if input from script contains NULs
X-Git-Tag: 2.3.4~266
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7ca38609f2d8032466f62a0a14d276abb17bca32;p=thirdparty%2Fdovecot%2Fcore.git

auth: checkpassword - Fail if input from script contains NULs

Previously the input was just silently truncated at NULs.
---

diff --git a/src/auth/db-checkpassword.c b/src/auth/db-checkpassword.c
index 47e1ef32c9..2fd4ed1630 100644
--- a/src/auth/db-checkpassword.c
+++ b/src/auth/db-checkpassword.c
@@ -303,7 +303,7 @@ static void checkpassword_child_input(struct chkpw_auth_request *request)
 
 	ret = read(request->fd_in, buf, sizeof(buf));
 	if (ret > 0) {
-		str_append_n(request->input_buf, buf, ret);
+		str_append_data(request->input_buf, buf, ret);
 		return;
 	}
 
@@ -311,6 +311,11 @@ static void checkpassword_child_input(struct chkpw_auth_request *request)
 		auth_request_log_error(request->request, AUTH_SUBSYS_DB,
 				       "read() failed: %m");
 		checkpassword_internal_failure(&request);
+	} else if (memchr(str_data(request->input_buf), '\0',
+			  str_len(request->input_buf)) != NULL) {
+		auth_request_log_error(request->request, AUTH_SUBSYS_DB,
+				       "NUL characters in checkpassword reply");
+		checkpassword_internal_failure(&request);
 	} else if (strchr(str_c(request->input_buf), '\n') != NULL) {
 		auth_request_log_error(request->request, AUTH_SUBSYS_DB,
 				       "LF characters in checkpassword reply");