[nginx] svn commit: r4816 - trunk/src/core
mdounin at mdounin.ru
mdounin at mdounin.ru
Thu Aug 16 12:05:58 UTC 2012
Author: mdounin
Date: 2012-08-16 12:05:58 +0000 (Thu, 16 Aug 2012)
New Revision: 4816
URL: http://trac.nginx.org/nginx/changeset/4816/nginx
Log:
Crypt: fixed handling of corrupted SSHA entries in password file.
Found by Coverity.
Modified:
trunk/src/core/ngx_crypt.c
Modified: trunk/src/core/ngx_crypt.c
===================================================================
--- trunk/src/core/ngx_crypt.c 2012-08-16 10:58:18 UTC (rev 4815)
+++ trunk/src/core/ngx_crypt.c 2012-08-16 12:05:58 UTC (rev 4816)
@@ -194,6 +194,7 @@
ngx_crypt_ssha(ngx_pool_t *pool, u_char *key, u_char *salt, u_char **encrypted)
{
size_t len;
+ ngx_int_t rc;
ngx_str_t encoded, decoded;
ngx_sha1_t sha1;
@@ -204,13 +205,19 @@
encoded.data = salt + sizeof("{SSHA}") - 1;
encoded.len = ngx_strlen(encoded.data);
- decoded.data = ngx_pnalloc(pool, ngx_base64_decoded_length(encoded.len));
+ len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
+
+ decoded.data = ngx_pnalloc(pool, len);
if (decoded.data == NULL) {
return NGX_ERROR;
}
- ngx_decode_base64(&decoded, &encoded);
+ rc = ngx_decode_base64(&decoded, &encoded);
+ if (rc != NGX_OK || decoded.len < 20) {
+ decoded.len = 20;
+ }
+
/* update SHA1 from key and salt */
ngx_sha1_init(&sha1);
More information about the nginx-devel
mailing list