logo

overlay

My own overlay for experimentations, use with caution, no support is provided git clone https://anongit.hacktivis.me/git/overlay.git/

shadow-4.9-SHA-rounds.patch (1714B)

    

  1. From 234e8fa7b134d1ebabfdad980a3ae5b63c046c62 Mon Sep 17 00:00:00 2001
  2. From: Mike Gilbert <floppym@gentoo.org>
  3. Date: Sat, 14 Aug 2021 13:24:34 -0400
  4. Subject: [PATCH] libmisc: fix default value in SHA_get_salt_rounds()
  6. If SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS are both unspecified,
  7. use SHA_ROUNDS_DEFAULT.
  9. Previously, the code fell through, calling shadow_random(-1, -1). This
  10. ultimately set rounds = (unsigned long) -1, which ends up being a very
  11. large number! This then got capped to SHA_ROUNDS_MAX later in the
  12. function.
  14. The new behavior matches BCRYPT_get_salt_rounds().
  16. Bug: https://bugs.gentoo.org/808195
  17. Fixes: https://github.com/shadow-maint/shadow/issues/393
  18. ---
  19.  libmisc/salt.c | 21 +++++++++++----------
  20.  1 file changed, 11 insertions(+), 10 deletions(-)
  22. diff --git a/libmisc/salt.c b/libmisc/salt.c
  23. index 91d528fd..30eefb9c 100644
  24. --- a/libmisc/salt.c
  25. +++ b/libmisc/salt.c
  26. @@ -223,20 +223,21 @@ static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *pre
  27.  		if ((-1 == min_rounds) && (-1 == max_rounds)) {
  28.  			rounds = SHA_ROUNDS_DEFAULT;
  29.  		}
  30. +		else {
  31. +			if (-1 == min_rounds) {
  32. +				min_rounds = max_rounds;
  33. +			}
  34.  
  35. -		if (-1 == min_rounds) {
  36. -			min_rounds = max_rounds;
  37. -		}
  38. +			if (-1 == max_rounds) {
  39. +				max_rounds = min_rounds;
  40. +			}
  41.  
  42. -		if (-1 == max_rounds) {
  43. -			max_rounds = min_rounds;
  44. -		}
  45. +			if (min_rounds > max_rounds) {
  46. +				max_rounds = min_rounds;
  47. +			}
  48.  
  49. -		if (min_rounds > max_rounds) {
  50. -			max_rounds = min_rounds;
  51. +			rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
  52.  		}
  53. -
  54. -		rounds = (unsigned long) shadow_random (min_rounds, max_rounds);
  55.  	} else if (0 == *prefered_rounds) {
  56.  		rounds = SHA_ROUNDS_DEFAULT;
  57.  	} else {