MD5crypt password fixes.

--HG--
branch : HEAD

diff --git a/src/auth/md5crypt.c b/src/auth/md5crypt.c
index 9b85e9da106045a1f931677c8a6c33a73763322a..7030d62a46599ba4f9f08edce5160193bdf0c5a0 100644 (file)
--- a/src/auth/md5crypt.c
+++ b/src/auth/md5crypt.c
@@ -44,11 +44,11 @@ to64(char *s, unsigned long v, int n)
  * Use MD5 for what it is best at...
  */
 
-char *
+const char *
 md5_crypt(const char *pw, const char *salt)
 {
-       static char     passwd[120], *p;
-       static const char *sp,*ep;
+       char passwd[120], *p;
+       const char *sp,*ep;
        unsigned char   final[16];
        int sl,pl,i,j;
        struct md5_context ctx,ctx1;
@@ -143,5 +143,5 @@ md5_crypt(const char *pw, const char *salt)
        /* Don't leave anything around in vm they could use. */
        memset(final,0,sizeof final);
 
-       return passwd;
+       return t_strdup(passwd);
 }

diff --git a/src/auth/md5crypt.h b/src/auth/md5crypt.h
index 99983388b1310e44c8b5bf504892ef1604855540..b277c9c61030a73380e3eea5918ed054097211d8 100644 (file)
--- a/src/auth/md5crypt.h
+++ b/src/auth/md5crypt.h
@@ -1,6 +1,6 @@
 #ifndef __MD5CRYPT_H
 #define __MD5CRYPT_H
 
-char *md5_crypt(const char *pw, const char *salt);
+const char *md5_crypt(const char *pw, const char *salt);
 
 #endif

diff --git a/src/auth/password-scheme.c b/src/auth/password-scheme.c
index 2f0f67a795ec206e70f45fe139949a19cf6e2450..cd189fdeac2acbc0f82658e8ef37ba897643a566 100644 (file)
--- a/src/auth/password-scheme.c
+++ b/src/auth/password-scheme.c
@@ -59,8 +59,15 @@ const char *password_get_scheme(const char **password)
                return NULL;
 
        if (strncmp(*password, "$1$", 3) == 0) {
-               *password = t_strcut(*password + 3, '$');
-               return "MD5";
+               /* skip the salt */
+               p = strchr(*password + 3, '$');
+               if (p != NULL) {
+                       /* stop at next '$' */
+                       p = strchr(p+1, '$');
+                       if (p != NULL)
+                               *password = t_strdup_until(*password, p);
+                       return "MD5";
+               }
        }
 
        if (**password != '{')