From: Timo Sirainen <timo.sirainen@open-xchange.com>
Date: Thu, 14 Oct 2021 21:48:41 +0000 (+0200)
Subject: auth: crypt_verify_blowfish() - Check $2 prefix without str_begins()
X-Git-Tag: 2.4.0~4245
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=41ab06e3cb82d4345da28738e26f13fe30fb43eb;p=thirdparty%2Fdovecot%2Fcore.git

auth: crypt_verify_blowfish() - Check $2 prefix without str_begins()

Although str_begins() works as well, it's a bit inconsistent looking here.
---

diff --git a/src/auth/password-scheme-crypt.c b/src/auth/password-scheme-crypt.c
index d00d0bde92..4abc8bfbd5 100644
--- a/src/auth/password-scheme-crypt.c
+++ b/src/auth/password-scheme-crypt.c
@@ -78,7 +78,7 @@ crypt_verify_blowfish(const char *plaintext, const struct password_generate_para
 	password = t_strndup(raw_password, size);
 
 	if (size < CRYPT_BLF_PREFIX_LEN ||
-	    !str_begins(password, "$2") ||
+	    password[0] != '$' || password[1] != '2' ||
 	    password[2] < 'a' || password[2] > 'z' ||
 	    password[3] != '$') {
 		*error_r = "Password is not blowfish password";