aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-extended/sudo/files/crypt.patch112
1 files changed, 94 insertions, 18 deletions
diff --git a/meta/recipes-extended/sudo/files/crypt.patch b/meta/recipes-extended/sudo/files/crypt.patch
index 53a257f52c..d0622d372c 100644
--- a/meta/recipes-extended/sudo/files/crypt.patch
+++ b/meta/recipes-extended/sudo/files/crypt.patch
@@ -1,24 +1,100 @@
-Staring from glibc 2.17 the crypt() function will error out and return NULL if
-the seed or "correct" is invalid. The failure case for this is the sudo user
-having a locked account in /etc/shadow, so their password is "!", which is an
-invalid hash. crypt() never returned NULL previously so this is crashing in
-strcmp().
-
-Upstream-Status: Pending
+Upstream-Status: Backport
Signed-off-by: Ross Burton <ross.burton@intel.com>
-Index: sudo-1.8.6p7/plugins/sudoers/auth/passwd.c
-===================================================================
---- sudo-1.8.6p7.orig/plugins/sudoers/auth/passwd.c 2013-04-11 15:26:28.456416867 +0100
-+++ sudo-1.8.6p7/plugins/sudoers/auth/passwd.c 2013-04-11 15:31:31.156421718 +0100
-@@ -96,7 +96,9 @@
+# HG changeset patch
+# User Todd C. Miller <Todd.Miller@courtesan.com>
+# Date 1365700240 14400
+# Node ID 887b9df243df5254e56c467a016f1b0a7a8507dd
+# Parent fd7eda53cdd76aaf8336800c61005ae93de95ac7
+Check for crypt() returning NULL. Traditionally, crypt() never returned
+NULL but newer versions of eglibc have a crypt() that does. Bug #598
+
+diff -r fd7eda53cdd7 -r 887b9df243df plugins/sudoers/auth/passwd.c
+--- a/plugins/sudoers/auth/passwd.c Thu Apr 11 09:09:53 2013 -0400
++++ b/plugins/sudoers/auth/passwd.c Thu Apr 11 13:10:40 2013 -0400
+@@ -68,15 +68,15 @@
+ char sav, *epass;
+ char *pw_epasswd = auth->data;
+ size_t pw_len;
+- int error;
++ int matched = 0;
+ debug_decl(sudo_passwd_verify, SUDO_DEBUG_AUTH)
+
+ pw_len = strlen(pw_epasswd);
+
+ #ifdef HAVE_GETAUTHUID
+ /* Ultrix shadow passwords may use crypt16() */
+- error = strcmp(pw_epasswd, (char *) crypt16(pass, pw_epasswd));
+- if (!error)
++ epass = (char *) crypt16(pass, pw_epasswd);
++ if (epass != NULL && strcmp(pw_epasswd, epass) == 0)
+ debug_return_int(AUTH_SUCCESS);
+ #endif /* HAVE_GETAUTHUID */
+
+@@ -95,12 +95,14 @@
*/
epass = (char *) crypt(pass, pw_epasswd);
pass[8] = sav;
- if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN)
-+ if (epass == NULL)
-+ error = AUTH_FAILURE;
-+ else if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN)
- error = strncmp(pw_epasswd, epass, DESLEN);
- else
- error = strcmp(pw_epasswd, epass);
+- error = strncmp(pw_epasswd, epass, DESLEN);
+- else
+- error = strcmp(pw_epasswd, epass);
++ if (epass != NULL) {
++ if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN)
++ matched = !strncmp(pw_epasswd, epass, DESLEN);
++ else
++ matched = !strcmp(pw_epasswd, epass);
++ }
+
+- debug_return_int(error ? AUTH_FAILURE : AUTH_SUCCESS);
++ debug_return_int(matched ? AUTH_SUCCESS : AUTH_FAILURE);
+ }
+
+ int
+diff -r fd7eda53cdd7 -r 887b9df243df plugins/sudoers/auth/secureware.c
+--- a/plugins/sudoers/auth/secureware.c Thu Apr 11 09:09:53 2013 -0400
++++ b/plugins/sudoers/auth/secureware.c Thu Apr 11 13:10:40 2013 -0400
+@@ -73,30 +73,28 @@
+ sudo_secureware_verify(struct passwd *pw, char *pass, sudo_auth *auth)
+ {
+ char *pw_epasswd = auth->data;
++ char *epass = NULL;
+ debug_decl(sudo_secureware_verify, SUDO_DEBUG_AUTH)
+ #ifdef __alpha
+ {
+ extern int crypt_type;
+
+-# ifdef HAVE_DISPCRYPT
+- if (strcmp(pw_epasswd, dispcrypt(pass, pw_epasswd, crypt_type)) == 0)
+- debug_return_int(AUTH_SUCCESS);
+-# else
+- if (crypt_type == AUTH_CRYPT_BIGCRYPT) {
+- if (strcmp(pw_epasswd, bigcrypt(pass, pw_epasswd)) == 0)
+- debug_return_int(AUTH_SUCCESS);
+- } else if (crypt_type == AUTH_CRYPT_CRYPT16) {
+- if (strcmp(pw_epasswd, crypt(pass, pw_epasswd)) == 0)
+- debug_return_int(AUTH_SUCCESS);
+- }
++# ifdef HAVE_DISPCRYPT
++ epass = dispcrypt(pass, pw_epasswd, crypt_type);
++# else
++ if (crypt_type == AUTH_CRYPT_BIGCRYPT)
++ epass = bigcrypt(pass, pw_epasswd);
++ else if (crypt_type == AUTH_CRYPT_CRYPT16)
++ epass = crypt(pass, pw_epasswd);
+ }
+-# endif /* HAVE_DISPCRYPT */
++# endif /* HAVE_DISPCRYPT */
+ #elif defined(HAVE_BIGCRYPT)
+- if (strcmp(pw_epasswd, bigcrypt(pass, pw_epasswd)) == 0)
+- debug_return_int(AUTH_SUCCESS);
++ epass = bigcrypt(pass, pw_epasswd);
+ #endif /* __alpha */
+
+- debug_return_int(AUTH_FAILURE);
++ if (epass != NULL && strcmp(pw_epasswd, epass) == 0)
++ debug_return_int(AUTH_SUCCESS);
++ debug_return_int(AUTH_FAILURE);
+ }
+
+ int