Changeset d028a77

Timestamp:

2006-06-19T11:52:34Z (18 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

84e9cea

Parents:

d28f3b35

Message:

Better detection of incorrect MD5 password hashes.

File:

• storage_xml.c (modified) (1 diff)

storage_xml.c

@@ -86 +86 @@
                         md5_byte_t pass_md5[16];
                         md5_state_t md5_state;
-                        int pass_match, i, j;
+                        int i, j;
                         
                         md5_init( &md5_state );
-                        md5_append( &md5_state, xd->given_pass, strlen( xd->given_pass ) );
+                        md5_append( &md5_state, (md5_byte_t*) xd->given_pass, strlen( xd->given_pass ) );
                         md5_finish( &md5_state, pass_md5 );
                         
-                        for( i = 0; i < 16 && pass[i*2] && pass[i*2+1]; i ++ )
+                        for( i = 0; i < 16; i ++ )
                         {
-                                sscanf( pass + i * 2, "%2x", &j );
+                                if( !isxdigit( pass[i*2] ) || !isxdigit( pass[i*2+1] ) ||
+                                     sscanf( pass + i * 2, "%2x", &j ) != 1 )
+                                {
+                                        g_set_error( error, G_MARKUP_ERROR, G_MARKUP_ERROR_INVALID_CONTENT,
+                                                     "Incorrect password MD5-hash" );
+                                        break;
+                                }
                                 if( j != pass_md5[i] )
+                                {
+                                        g_set_error( error, G_MARKUP_ERROR, G_MARKUP_ERROR_INVALID_CONTENT,
+                                                     XML_PASS_ERRORMSG );
                                         break;
+                                }
                         }
+                        
                         /* If we reached the end of the loop, it was a match! */
-                        pass_match = i == 16;
-                        
-                        if( strcmp( nick, xd->given_nick ) == 0 && pass_match )
+                        if( i == 16 )
                         {
                                 if( xd->pass_st != XML_PASS_CHECK_ONLY )
                                         xd->pass_st = XML_PASS_OK;
-                        }
-                        else
-                        {
-                                g_set_error( error, G_MARKUP_ERROR, G_MARKUP_ERROR_INVALID_CONTENT,
-                                             XML_PASS_ERRORMSG );
                         }
                 }