mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-30 21:32:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

tinylogin: fix segfault from crypt()

Browse Source 
In glibc 2.17, crypt() now expects 2 valid chars for the seed or
it will error out and return a NULL. The tinylogin code took the
result from crypt directly into a strcmp() which caused a segfault

Tinylogin has been deperacted, busybox now has login support, I will
investigate using busybox login support for 1.5.

[YOCTO #4097]

(From OE-Core rev: 03034e0f5dff426ee7adaa2364082dd47c23260a)

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Saul Wold
2013-04-05 10:09:31 -07:00
committed by Richard Purdie
parent 04b799b3c8
commit 59c073514c
2 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
meta/recipes-core/tinylogin/tinylogin-1.4/glibc_crypt_fix.patch Normal file
View File

@@ -0,0 +1,23 @@
staring from glibc 2.17 the crypt() function will error out and return
NULL if the seed or "correct" is invalid. The failure case for this is
an unknown user which tinylogin assigns '!' for the password. crypt()
now expects a minimum of 2 valid characters. If we get a NULL return
value from the crypt, assume we fail and return 0.
Upstream-Status: Inappropriate [tinylogin depercated]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Index: tinylogin-1.4/libbb/correct_password.c
===================================================================
--- tinylogin-1.4.orig/libbb/correct_password.c
+++ tinylogin-1.4/libbb/correct_password.c
@@ -74,5 +74,8 @@ int correct_password ( const struct pass
}
encrypted = crypt ( unencrypted, correct );
memset ( unencrypted, 0, xstrlen ( unencrypted ));
+ if ( !encrypted )
+ return 0;
+
return ( strcmp ( encrypted, correct ) == 0 ) ? 1 : 0;
}

4
meta/recipes-core/tinylogin/tinylogin_1.4.bb
View File

@@ -18,7 +18,9 @@ SRC_URI = "http://www.angstrom-distribution.org/unstable/sources/tinylogin-${PV}
file://remove-index.patch \
file://use_O2_option.patch \
file://passwd_rotate_check.patch \
file://avoid_static.patch"
file://avoid_static.patch \
file://glibc_crypt_fix.patch \
"
SRC_URI[md5sum] = "44da0ff2b727455669890b24305e351d"
SRC_URI[sha256sum] = "5e542e4b7825305a3678bf73136c392feb0d44b8bbf926e8eda5453eea7ddd6b"