sysmo-bts
/
generic-poky
9
0
Fork 0
Code Pull Requests Releases Activity

shadow: add patch to fix crypt: Invalid Argument 

This patch came from Slackware and address a change in crypt()'s handling
of an invalid seed, which in the past returned an encrypted string and now
returns a NULL.

[YOCTO #4097] related to tinylogin segfault

(From OE-Core rev: a7f7e6da8383b4bde6d8ce951e5c3c955073c0bd)

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Saul Wold 2013-04-05 10:09:32 -07:00 committed by Richard Purdie
parent 59c073514c
commit 216d701c01
2 changed files with 64 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
meta/recipes-extended/shadow/files/slackware_fix_for_glib-2.17_crypt.patch Normal file
View File

@ -0,0 +1,63 @@
This patch is from Slackware, I tried to find the actual
author to add that attribution. The comment below is the
best summary, I will not repeat it here.
Upstream-Status: Backport from slackware
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Index: shadow-4.1.4.3/lib/encrypt.c
===================================================================
--- shadow-4.1.4.3.orig/lib/encrypt.c
+++ shadow-4.1.4.3/lib/encrypt.c
@@ -45,15 +45,40 @@ char *pw_encrypt (const char *clear, con
static char cipher[128];
char *cp;
- cp = crypt (clear, salt);
- if (!cp) {
- /*
- * Single Unix Spec: crypt() may return a null pointer,
- * and set errno to indicate an error. The caller doesn't
- * expect us to return NULL, so...
- */
- perror ("crypt");
- exit (EXIT_FAILURE);
+ cp = crypt (clear, salt);
+ if (!cp) {
+ /*
+ * In glibc-2.17 and newer, crypt() will return NULL if
+ * it was called using an invalid salt format. Previous
+ * versions of glibc would go ahead and compute a DES hash
+ * using the invalid salt. The salt value in this case was
+ * always '!'. We might arrive at this place if either the
+ * user does not exist, or if the hash in /etc/shadow doesn't
+ * have the proper magic for one of the supported hash
+ * formats (for example, if the account was locked using
+ * "passwd -l". To handle this situation, we will recompute
+ * the hash using a hardcoded salt as was previously done
+ * by glibc. The hash returned by the old glibc function
+ * always began with "!!", which would ensure that it could
+ * never match an otherwise valid hash in /etc/shadow that
+ * was disabled with a "!" at the beginning (since the second
+ * character would never be "!" as well), so we will also
+ * prepend the resulting hash with "!!". Finally, in case
+ * crypt() failed for some other reason we will check to see
+ * if we still get NULL from crypt even with the valid salt
+ * and will fail if that's the case.
+ */
+
+ /* Recalculate hash using a hardcoded, valid SHA512 salt: */
+ cp = crypt (clear, "$6$8IIcy/1EPOk/");
+
+ if (!cp) {
+ perror ("crypt");
+ exit (EXIT_FAILURE);
+ } else {
+ sprintf (cipher, "!!%s", cp);
+ return cipher;
+ }
}
/* The GNU crypt does not return NULL if the algorithm is not

1
meta/recipes-extended/shadow/shadow_4.1.4.3.bb
View File

@ -23,6 +23,7 @@ SRC_URI = "http://pkg-shadow.alioth.debian.org/releases/${BPN}-${PV}.tar.bz2 \
file://shadow-4.1.4.2-su_no_sanitize_env.patch \
file://shadow-update-pam-conf.patch \
file://shadow_fix_for_automake-1.12.patch \
file://slackware_fix_for_glib-2.17_crypt.patch \
"
SRC_URI[md5sum] = "b8608d8294ac88974f27b20f991c0e79"