opensmtpd: add patch to avoid segfault on password check

This commit is contained in:
johannes 2018-02-22 16:21:40 +01:00 committed by Michael Gehring
parent 068b71111f
commit 18de9e945d
2 changed files with 38 additions and 1 deletions

View file

@ -0,0 +1,37 @@
https://github.com/OpenSMTPD/OpenSMTPD/pull/835
avoid null pointer deref if crypt(3) fails and returns null
include "includes.h" so HAVE_CRYPT_H is defined and crypt.h gets included
--- openbsd-compat/crypt_checkpass.c
+++ openbsd-compat/crypt_checkpass.c
@@ -1,5 +1,6 @@
/* OPENBSD ORIGINAL: lib/libc/crypt/cryptutil.c */
+#include "includes.h"
#include <errno.h>
#ifdef HAVE_CRYPT_H
#include <crypt.h>
@@ -10,6 +11,8 @@
int
crypt_checkpass(const char *pass, const char *goodhash)
{
+ char *c;
+
if (goodhash == NULL)
goto fail;
@@ -17,7 +20,11 @@ crypt_checkpass(const char *pass, const char *goodhash)
if (strlen(goodhash) == 0 && strlen(pass) == 0)
return 0;
- if (strcmp(crypt(pass, goodhash), goodhash) == 0)
+ c = crypt(pass, goodhash);
+ if (c == NULL)
+ goto fail;
+
+ if (strcmp(c, goodhash) == 0)
return 0;
fail:

View file

@ -1,7 +1,7 @@
# Template file for 'opensmtpd'
pkgname=opensmtpd
version=6.0.3p1
revision=5
revision=6
build_style=gnu-configure
configure_args="--sysconfdir=/etc/smtpd --sbindir=/usr/bin
--with-path-socket=/run --with-mantype=doc --with-pie --with-table-db