src/passwd.c: inconsistent password length limit

The passwd utility had hardcoded limit for password lenght set
to 200 characters. In the agetpass.c is used PASS_MAX for
this purpose.

This patch moves the PASS_MAX definition to common place
and uses it in both places.

Signed-off-by: Tomas Halman <tomas@halman.net>

diff --git a/lib/agetpass.c b/lib/agetpass.c
index 11809ab74b08de8b8da790649c5f32741ded2506..5d9f9286d353c37197381dcec6e8501593e3cfb6 100644 (file)
--- a/lib/agetpass.c
+++ b/lib/agetpass.c
@@ -11,7 +11,6 @@
 
 #include <limits.h>
 #include <readpassphrase.h>
-#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -24,11 +23,6 @@
 #endif /* WITH_LIBBSD */
 
 
-#if !defined(PASS_MAX)
-#define PASS_MAX  BUFSIZ - 1
-#endif
-
-
 /*
  * SYNOPSIS
  *     [[gnu::malloc(erase_pass)]]

diff --git a/lib/defines.h b/lib/defines.h
index 93543e85830d5f63d5cf9d83acf8be73d80e0095..8c55dddbc1622083eaa6230124d1700d693416d2 100644 (file)
--- a/lib/defines.h
+++ b/lib/defines.h
@@ -25,6 +25,7 @@
     ((N) == 1 ? (const char *) (Msgid1) : (const char *) (Msgid2))
 #endif
 
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -202,4 +203,14 @@
 #  define shadow_getenv(name) getenv(name)
 #endif
 
+/*
+ * Maximum password length
+ *
+ * Consider that there is also limit in PAM (PAM_MAX_RESP_SIZE)
+ * currently set to 512.
+ */
+#if !defined(PASS_MAX)
+#define PASS_MAX  BUFSIZ - 1
+#endif
+
 #endif                         /* _DEFINES_H_ */

diff --git a/src/passwd.c b/src/passwd.c
index 939ad79d46228ae0c76c07d1fc7811c939365993..3e0a6eb81aeb83fcc61b6b8c36742d632699267e 100644 (file)
--- a/src/passwd.c
+++ b/src/passwd.c
@@ -175,8 +175,8 @@ static int new_password (const struct passwd *pw)
        char *cipher;           /* Pointer to cipher text */
        const char *salt;       /* Pointer to new salt */
        char *cp;               /* Pointer to agetpass() response */
-       char orig[200];         /* Original password */
-       char pass[200];         /* New password */
+       char orig[PASS_MAX + 1];        /* Original password */
+       char pass[PASS_MAX + 1];        /* New password */
        int i;                  /* Counter for retries */
        bool warned;
        int pass_max_len = -1;