codesite-noreply at google
Oct 14, 2009, 10:15 AM
Post #4 of 5
(82 views)
Permalink
|
|
Issue 593 in cherokee: Segmentation fault in validator_htpasswd
[In reply to]
|
|
Updates:
Status: Accepted
Comment #3 on issue 593 by ste...@konink.de: Segmentation fault in
validator_htpasswd
http://code.google.com/p/cherokee/issues/detail?id=593
See what happens if you actually pass null into it. It will never work
unless you explicitly check for it. Since the cherokee buffer routines
with len 0 will always have a null thus:
/* The password first, since that is what is most unknown */
MD5Update(&ctx, (unsigned char *)pw, strlen(pw));
...fails hard.
The only thing for fixing empty passwords would be something like:
if (pw)
MD5Update(&ctx, (unsigned char *)pw, strlen(pw));
But this would already be complete nonsense... because you actually
disgard any users that don't have a password in the file.
/* Split into user and encrypted password.
*/
cryp = strchr (line, ':');
if (cryp == NULL) continue;
Thus: revert the revert. The feature is not supported. And if supported
hence: it is in the bugtracker someone whining about it ;) You would
have to make the actual user also 'optional' ;)
/* Split into user and encrypted password.
*/
cryp = strchr (line, ':');
if (cryp != NULL)
*cryp++ = '\0';
cryp_len = strlen(cryp);
/* Is this the right user?
*/
if (strcmp (conn->validator->user.buf, line) != 0) {
continue;
}
/* Check the type of the crypted password:
* It recognizes: Apache MD5, MD5, SHA, old crypt and
plain text
*/
if (cryp == NULL) {
if (conn->validator->passwd.buf == NULL) {
ret_auth = ret_ok;
else
ret_auth = ret_error;
} else if (strncmp (cryp, "$apr1$", 6) == 0) {
Then you can remove all explicit buffer empty things too. I think this
is all one very bad idea.
--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
_______________________________________________
Cherokee-dev mailing list
Cherokee-dev[at]lists.octality.com
http://lists.octality.com/listinfo/cherokee-dev
|
