From: Karel Zak <kzak@redhat.com>
Date: Fri, 1 Feb 2013 17:00:52 +0000 (+0100)
Subject: newgrp: more robust crypt() usage
X-Git-Tag: v2.23-rc1~257
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=19a1ca6c0dcf64aa01e24c6b235c81413580804d;p=thirdparty%2Futil-linux.git

newgrp: more robust crypt() usage

Signed-off-by: Karel Zak <kzak@redhat.com>
---

diff --git a/login-utils/newgrp.c b/login-utils/newgrp.c
index 4f6de12a14..cca7b32446 100644
--- a/login-utils/newgrp.c
+++ b/login-utils/newgrp.c
@@ -98,10 +98,14 @@ static int allow_setgid(struct passwd *pe, struct group *ge)
 	if (!(pwd = get_gshadow_pwd(ge->gr_name)))
 		pwd = ge->gr_passwd;
 
-	if (pwd && *pwd && (xpwd = getpass(_("Password: "))))
-		if (strcmp(pwd, crypt(xpwd, pwd)) == 0)
-			/* password accepted */
+	if (pwd && *pwd && (xpwd = getpass(_("Password: ")))) {
+		char *cbuf = crypt(xpwd, pwd);
+
+		if (!cbuf)
+			warn(_("crypt() failed"));
+		else if (strcmp(pwd, cbuf) == 0)
 			return TRUE;
+	}
 
 	/* default to denial */
 	return FALSE;