From 437b273761adedcbd880f714bfa44afeec186a31 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Sun, 5 Aug 2018 19:04:38 -0700 Subject: Don't crash if crypt() fails. It can fail, so make sure it doesn't before comparing its result with the password. This addresses Include Security issue F12: [libpcap] Remote Packet Capture Daemon Null Pointer Dereference Denial of Service. --- rpcapd/daemon.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'rpcapd') diff --git a/rpcapd/daemon.c b/rpcapd/daemon.c index 98163289..c9b44aaf 100644 --- a/rpcapd/daemon.c +++ b/rpcapd/daemon.c @@ -1222,6 +1222,7 @@ daemon_AuthUserPwd(char *username, char *password, char *errbuf) #ifdef HAVE_GETSPNAM struct spwd *usersp; #endif + char *crypt_password; // This call is needed to get the uid if ((user = getpwnam(username)) == NULL) @@ -1252,7 +1253,13 @@ daemon_AuthUserPwd(char *username, char *password, char *errbuf) user_password = user->pw_passwd; #endif - if (strcmp(user_password, (char *) crypt(password, user_password)) != 0) + crypt_password = crypt(password, user_password); + if (crypt_password == NULL) + { + pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Authentication failed"); + return -1; + } + if (strcmp(user_password, crypt_password) != 0) { pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Authentication failed: user name or password incorrect"); return -1; -- cgit v1.2.1