From a7f7e6da8383b4bde6d8ce951e5c3c955073c0bd Mon Sep 17 00:00:00 2001 From: Saul Wold Date: Fri, 5 Apr 2013 10:09:32 -0700 Subject: shadow: add patch to fix crypt: Invalid Argument This patch came from Slackware and address a change in crypt()'s handling of an invalid seed, which in the past returned an encrypted string and now returns a NULL. [YOCTO #4097] related to tinylogin segfault Signed-off-by: Saul Wold Signed-off-by: Richard Purdie --- .../files/slackware_fix_for_glib-2.17_crypt.patch | 63 ++++++++++++++++++++++ meta/recipes-extended/shadow/shadow_4.1.4.3.bb | 1 + 2 files changed, 64 insertions(+) create mode 100644 meta/recipes-extended/shadow/files/slackware_fix_for_glib-2.17_crypt.patch (limited to 'meta/recipes-extended') diff --git a/meta/recipes-extended/shadow/files/slackware_fix_for_glib-2.17_crypt.patch b/meta/recipes-extended/shadow/files/slackware_fix_for_glib-2.17_crypt.patch new file mode 100644 index 0000000000..7cd45afebb --- /dev/null +++ b/meta/recipes-extended/shadow/files/slackware_fix_for_glib-2.17_crypt.patch @@ -0,0 +1,63 @@ + +This patch is from Slackware, I tried to find the actual +author to add that attribution. The comment below is the +best summary, I will not repeat it here. + +Upstream-Status: Backport from slackware + +Signed-off-by: Saul Wold + +Index: shadow-4.1.4.3/lib/encrypt.c +=================================================================== +--- shadow-4.1.4.3.orig/lib/encrypt.c ++++ shadow-4.1.4.3/lib/encrypt.c +@@ -45,15 +45,40 @@ char *pw_encrypt (const char *clear, con + static char cipher[128]; + char *cp; + +- cp = crypt (clear, salt); +- if (!cp) { +- /* +- * Single Unix Spec: crypt() may return a null pointer, +- * and set errno to indicate an error. The caller doesn't +- * expect us to return NULL, so... +- */ +- perror ("crypt"); +- exit (EXIT_FAILURE); ++ cp = crypt (clear, salt); ++ if (!cp) { ++ /* ++ * In glibc-2.17 and newer, crypt() will return NULL if ++ * it was called using an invalid salt format. Previous ++ * versions of glibc would go ahead and compute a DES hash ++ * using the invalid salt. The salt value in this case was ++ * always '!'. We might arrive at this place if either the ++ * user does not exist, or if the hash in /etc/shadow doesn't ++ * have the proper magic for one of the supported hash ++ * formats (for example, if the account was locked using ++ * "passwd -l". To handle this situation, we will recompute ++ * the hash using a hardcoded salt as was previously done ++ * by glibc. The hash returned by the old glibc function ++ * always began with "!!", which would ensure that it could ++ * never match an otherwise valid hash in /etc/shadow that ++ * was disabled with a "!" at the beginning (since the second ++ * character would never be "!" as well), so we will also ++ * prepend the resulting hash with "!!". Finally, in case ++ * crypt() failed for some other reason we will check to see ++ * if we still get NULL from crypt even with the valid salt ++ * and will fail if that's the case. ++ */ ++ ++ /* Recalculate hash using a hardcoded, valid SHA512 salt: */ ++ cp = crypt (clear, "$6$8IIcy/1EPOk/"); ++ ++ if (!cp) { ++ perror ("crypt"); ++ exit (EXIT_FAILURE); ++ } else { ++ sprintf (cipher, "!!%s", cp); ++ return cipher; ++ } + } + + /* The GNU crypt does not return NULL if the algorithm is not diff --git a/meta/recipes-extended/shadow/shadow_4.1.4.3.bb b/meta/recipes-extended/shadow/shadow_4.1.4.3.bb index 8226a6e3b3..caf24c06af 100644 --- a/meta/recipes-extended/shadow/shadow_4.1.4.3.bb +++ b/meta/recipes-extended/shadow/shadow_4.1.4.3.bb @@ -23,6 +23,7 @@ SRC_URI = "http://pkg-shadow.alioth.debian.org/releases/${BPN}-${PV}.tar.bz2 \ file://shadow-4.1.4.2-su_no_sanitize_env.patch \ file://shadow-update-pam-conf.patch \ file://shadow_fix_for_automake-1.12.patch \ + file://slackware_fix_for_glib-2.17_crypt.patch \ " SRC_URI[md5sum] = "b8608d8294ac88974f27b20f991c0e79" -- cgit 1.2.3-korg