sergiotarxz/nuttx-apps
sergiotarxz/nuttx-apps
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fsutils/passwd: fix out of bounds array access during password encryption

Browse Source 
Signed-off-by: Petro Karashchenko <petro.karashchenko@gmail.com>
This commit is contained in:
Petro Karashchenko 2022-03-28 13:13:53 +02:00 committed by Xiang Xiao
parent 2831af6395
commit d868387148
2 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
fsutils/passwd/passwd_encrypt.c
View File

@ -93,11 +93,11 @@ static char passwd_base64(uint8_t binary)
/* 62 -> '+' */
binary -= 10;
if (binary == 0)
{
return '+';
}
binary -= 10;
if (binary == 0)
{
return '+';
}
/* 63 -> '/' */
@ -123,7 +123,8 @@ static char passwd_base64(uint8_t binary)
*
****************************************************************************/
int passwd_encrypt(FAR const char *password, char encrypted[MAX_ENCRYPTED + 1])
int passwd_encrypt(FAR const char *password,
char encrypted[MAX_ENCRYPTED + 1])
{
union
{
@ -138,7 +139,6 @@ int passwd_encrypt(FAR const char *password, char encrypted[MAX_ENCRYPTED + 1])
uint32_t tmp;
uint8_t remainder;
int remaining;
int converted;
int gulpsize;
int nbits;
int i;
@ -160,11 +160,11 @@ int passwd_encrypt(FAR const char *password, char encrypted[MAX_ENCRYPTED + 1])
remainder = 0;
nbits = 0;
for (converted = 0; converted < remaining; converted += 8)
for (; remaining > 0; remaining -= gulpsize)
{
/* Copy bytes */
gulpsize = 8;
gulpsize = sizeof(value.b);
if (gulpsize > remaining)
{
gulpsize = remaining;
@ -178,7 +178,7 @@ int passwd_encrypt(FAR const char *password, char encrypted[MAX_ENCRYPTED + 1])
/* Pad with spaces if necessary */
for (; i < 8; i++)
for (; i < sizeof(value.b); i++)
{
*bptr++ = ' ';
}

2
nshlib/nsh_passwdcmds.c
View File

@ -80,7 +80,7 @@ int cmd_userdel(FAR struct nsh_vtbl_s *vtbl, int argc, char **argv)
#endif /* !CONFIG_NSH_DISABLE_USERDEL */
/****************************************************************************
* Name: cmd_useradd
* Name: cmd_passwd
****************************************************************************/
#ifndef CONFIG_NSH_DISABLE_PASSWD