From b0b19cf4a46b55a54be5a12e03b3eed244621cb4 Mon Sep 17 00:00:00 2001 From: Kaz Kylheku Date: Tue, 4 Jul 2023 22:02:41 -0700 Subject: crypt: handle libxcrypt failure tokens. Some OS distros have switched to a library called libxcrypt, which, instead of returning null on failure, like the Glibc crypt, returns a valid "failure token" string starting with a * character, which is guaranteed to be different from the salt argument. We should check for this so that we handle errors uniformly. Users are reporting failing crypt tests that are coming up with "*0" instead of throwing an exception. * sysif.c (crypt_wrap): Only accept a non-null result if it isn't one of the two strings "*0" and "*1". --- sysif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sysif.c b/sysif.c index 2f10720e..d845c8ad 100644 --- a/sysif.c +++ b/sysif.c @@ -2081,7 +2081,9 @@ static val crypt_wrap(val wkey, val wsalt) free(key); free(salt); - if (hash != 0) { + /* libxcrypt puts out two possible failure tokens "*0" or "*1". + */ + if (hash != 0 && strcmp(hash, "*0") != 0 && strcmp(hash, "*1") != 0) { val ret = string_utf8(hash); #if HAVE_CRYPT_R free(cd); -- cgit v1.2.3