git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/3] git-cvsserver: protect against NULL in crypt(3)

From
Carlo Arenas <carenas@gmail.com>
Date
Sep 16, 2021, 22:44 UTC
Message-ID
<CAPUEspjqD5zy8TLuFA96usU7FYi=0wF84y7NgOVFqegtxL9zbw@mail.gmail.com>
In-Reply-To
<xmqqczp8rx1c.fsf@gitster.g>
On Thu, Sep 16, 2021 at 3:11 PM Junio C Hamano <gitster@pobox.com> wrote:
Show 24 quoted lines
>
> Carlo Marcelo Arenas Belón  <carenas@gmail.com> writes:
>
> > -                if (crypt(descramble($password), $1) eq $1) {
> > -                    $auth_ok = 1;
> > +                my $hash = crypt(descramble($password), $1);
> > +                if (defined $hash) {
> > +                    $auth_ok = 1 if $hash eq $1;
> >                  }
>
> It is not wrong per-se to separate the two checks into two separate
> parts of the conditional, but because we check for definedness only
> because comparison of it with $1 makes sense only when it is
> defined, writing it either like this,
>
>                 if (defined $hash and $hash eq $1) {
>                         $auth_ok = 1;
>                 }
>
> or even like this,
>
>                 $auth_ok = (defined $hash and $hash eq $1);
>
> may be easier to read, no?

yes, let's go with the earlier; I was trying to mimic the original code, but agree on a second read that it looks confusing. assuming there are no more comments, would you want a reroll?

Carlo
Previous: Junio C HamanoNext: Junio C Hamano
Message 5 of 7 in “cvsserver: correctly validate pserver passwords”
  1. 0/3 cvsserver: correctly validate pserver passwordsCarlo Marcelo Arenas Belón, Sep 15, 2021
  2. 1/3 git-cvsserver: use crypt correctly to compare password hashesCarlo Marcelo Arenas Belón, Sep 15, 2021
  3. 2/3 git-cvsserver: protect against NULL in crypt(3)Carlo Marcelo Arenas Belón, Sep 15, 2021
  4. Junio C HamanoSep 16, 2021
  5. Carlo ArenasSep 16, 2021
  6. Junio C HamanoSep 17, 2021
  7. 3/3 Documentation: cleanup git-cvsserverCarlo Marcelo Arenas Belón, Sep 15, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.