external/cde
1
0
Fork 0
mirror of git://git.code.sf.net/p/cdesktopenv/code synced 2025-03-09 15:50:02 +00:00
Code Issues Releases Wiki Activity

Fixes the bug #17 dtsession can't validate passwords longer than 8 characters when the session is locked

Browse source
This commit is contained in:
Eugene Doudine 2014-03-23 07:32:02 +02:00 • committed by Jon Trulson
parent 23e62e5782
commit cd82567977
2 changed files with 44 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

79
cde/programs/dtsession/SmLock.c
View file

@ -969,19 +969,27 @@ CheckString(
register char *s, register char *s,
register int i ) register int i )
{ {
/* maximum supported length of password */
#if defined(SIA)
#define MAX_PASSWORD_LENGTH SIAMXPASSWORD
#else
/* seems to be reasonable maximal length */
#define MAX_PASSWORD_LENGTH 65535
#endif
/* step when allocating/extending buffer */
#define BUF_ALLOC_LEN 64
/* /*
* password rules: * password rules:
* - Only the first eight characters are used. * - If pw_length > MAX_PASSWORD_LENGTH, we've gone over the limit and won't
* - If pw_length > 8, we've gone over eight characters and won't
* accept any more. * accept any more.
* - An ESC kills the line. * - An ESC kills the line.
*/ */
#ifdef SIA static char *passwd = NULL; /* password space */
static char passwd[82]; /* password space */ static int pw_buf_length = 0; /* length of allocated password buffer */
#else
static char passwd[10]; /* password space */
#endif
static int pw_length = 0; /* password length */ static int pw_length = 0; /* password length */
char * tmpptr;
if (s == NULL) if (s == NULL)
{ {
@ -991,9 +999,23 @@ CheckString(
pw_length = 0; pw_length = 0;
return; return;
} }
for (; i>0; s++,i--) for (; i>0; s++,i--)
{ {
/* extend buffer by BUF_ALLOC_LEN bytes if needed*/
#ifdef JET_AUTHDEBUG
fprintf(stderr, "CheckString: pw_length=%d\n",pw_length);
#endif
if (pw_length == pw_buf_length)
{
tmpptr = SM_REALLOC(passwd, pw_buf_length + BUF_ALLOC_LEN);
if (!tmpptr) {
PrintErrnoError(DtError, smNLS.cantMallocErrorString);
return;
}
pw_buf_length += BUF_ALLOC_LEN;
passwd = tmpptr;
}
switch(*s) switch(*s)
{ {
case '\010': case '\010':
@ -1007,17 +1029,10 @@ CheckString(
case '\n': case '\n':
case '\r': case '\r':
#ifdef SIA if (pw_length > MAX_PASSWORD_LENGTH)
if (pw_length > 80)
{ {
pw_length = 80; pw_length = MAX_PASSWORD_LENGTH;
} }
#else
if (pw_length > 8)
{
pw_length = 8;
}
#endif
passwd[pw_length] = '\0'; /* terminate string */ passwd[pw_length] = '\0'; /* terminate string */
pw_length = 0; /* reset length */ pw_length = 0; /* reset length */
if (CheckPassword(passwd)) if (CheckPassword(passwd))
@ -1030,34 +1045,14 @@ CheckString(
break; break;
default: default:
#ifdef SIA if (pw_length < MAX_PASSWORD_LENGTH)
if (pw_length < 80) {
#else passwd[pw_length++] = *s; /* store character */
if (pw_length < 8) }
#endif
passwd[pw_length] = *s; /* store character */
/*
* The length is incremented no matter what, so the user can
* think the program handles multi-thousand-character
* passwords. If the user types twenty characters and eighteen
* erases (#), the result will be the first two characters
* entered, as expected. Up to a point -- 65536 is long
* enough!
*/
if (pw_length < 65535)
pw_length++;
break; break;
} }
} }
UpdatePasswdField(pw_length > MAX_PASSWORD_LENGTH ? MAX_PASSWORD_LENGTH : pw_length);
if(pw_length > 8)
{
UpdatePasswdField(8);
}
else
{
UpdatePasswdField(pw_length);
}
} }

8
cde/programs/dtsession/SmUI.c
View file

@ -1686,9 +1686,13 @@ UpdatePasswdField(
int numChars ) int numChars )
{ {
int i, index; int i, index;
char passwdMessage[25]; char *passwdMessage = XtMalloc(numChars + 1);
XmString tmpString; XmString tmpString;
if (!passwdMessage) {
PrintErrnoError(DtError, smNLS.cantMallocErrorString);
return;
}
if(numChars > 0) if(numChars > 0)
{ {
@ -1708,7 +1712,7 @@ UpdatePasswdField(
} }
tmpString = XmStringCreateLocalized (passwdMessage); tmpString = XmStringCreateLocalized (passwdMessage);
XtFree(passwdMessage);
/* /*
* Set the index for the indLabel widget * Set the index for the indLabel widget
*/ */