git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/3] git-cvsserver: protect against NULL in crypt(3)

From
Junio C Hamano <gitster@pobox.com>
Date
Sep 16, 2021, 22:11 UTC
Message-ID
<xmqqczp8rx1c.fsf@gitster.g>
In-Reply-To
<20210915080948.11891-3-carenas@gmail.com>
Carlo Marcelo Arenas Belón  <carenas@gmail.com> writes:
Show 6 quoted lines
> -                if (crypt(descramble($password), $1) eq $1) {
> -                    $auth_ok = 1;
> +                my $hash = crypt(descramble($password), $1);
> +                if (defined $hash) {
> +                    $auth_ok = 1 if $hash eq $1;
>                  }

It is not wrong per-se to separate the two checks into two separate parts of the conditional, but because we check for definedness only because comparison of it with $1 makes sense only when it is defined, writing it either like this,

		if (defined $hash and $hash eq $1) {
			$auth_ok = 1;
		}
or even like this,
		$auth_ok = (defined $hash and $hash eq $1);
may be easier to read, no?
Previous: Carlo Marcelo Arenas BelónNext: Carlo Arenas
Message 4 of 7 in “cvsserver: correctly validate pserver passwords”
  1. 0/3 cvsserver: correctly validate pserver passwordsCarlo Marcelo Arenas Belón, Sep 15, 2021
  2. 1/3 git-cvsserver: use crypt correctly to compare password hashesCarlo Marcelo Arenas Belón, Sep 15, 2021
  3. 2/3 git-cvsserver: protect against NULL in crypt(3)Carlo Marcelo Arenas Belón, Sep 15, 2021
  4. Junio C HamanoSep 16, 2021
  5. Carlo ArenasSep 16, 2021
  6. Junio C HamanoSep 17, 2021
  7. 3/3 Documentation: cleanup git-cvsserverCarlo Marcelo Arenas Belón, Sep 15, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.