From 19a1ca6c0dcf64aa01e24c6b235c81413580804d Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Fri, 1 Feb 2013 18:00:52 +0100 Subject: [PATCH] newgrp: more robust crypt() usage Signed-off-by: Karel Zak --- login-utils/newgrp.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/login-utils/newgrp.c b/login-utils/newgrp.c index 4f6de12a14..cca7b32446 100644 --- a/login-utils/newgrp.c +++ b/login-utils/newgrp.c @@ -98,10 +98,14 @@ static int allow_setgid(struct passwd *pe, struct group *ge) if (!(pwd = get_gshadow_pwd(ge->gr_name))) pwd = ge->gr_passwd; - if (pwd && *pwd && (xpwd = getpass(_("Password: ")))) - if (strcmp(pwd, crypt(xpwd, pwd)) == 0) - /* password accepted */ + if (pwd && *pwd && (xpwd = getpass(_("Password: ")))) { + char *cbuf = crypt(xpwd, pwd); + + if (!cbuf) + warn(_("crypt() failed")); + else if (strcmp(pwd, cbuf) == 0) return TRUE; + } /* default to denial */ return FALSE; -- 2.47.3