database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-27 12:41:57 +03:00
Code Activity

pgcrypto: Detect and report too-short crypt() salts.

Browse Source 
Certain short salts crashed the backend or disclosed a few bytes of
backend memory.  For existing salt-induced error conditions, emit a
message saying as much.  Back-patch to 9.0 (all supported versions).

Josh Kupershmidt

Security: CVE-2015-5288
This commit is contained in:
Noah Misch
2015-10-05 10:06:29 -04:00
parent 2ca9d5445c
commit 1d812c8b05
9 changed files with 103 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/pgcrypto/px-crypt.c
View File

@ -42,7 +42,7 @@ run_crypt_des(const char *psw, const char *salt,
char *res;
res = px_crypt_des(psw, salt);
if (strlen(res) > len - 1)
if (res == NULL || strlen(res) > len - 1)
return NULL;
strcpy(buf, res);
return buf;