You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@apr.apache.org by bo...@apache.org on 2009/01/05 03:19:27 UTC
svn commit: r731414 - in /apr/apr-util/branches/1.4.x: CHANGES
crypto/apr_sha1.c
Author: bojan
Date: Sun Jan 4 18:19:27 2009
New Revision: 731414
URL: http://svn.apache.org/viewvc?rev=731414&view=rev
Log:
Backport r731413 from the trunk.
Fix a buffer overrun and password matching for SHA passwords.
PR 45679.
Patch by Ben Noordhuis <bnoordhuis gmail.com>.
Modified:
apr/apr-util/branches/1.4.x/CHANGES
apr/apr-util/branches/1.4.x/crypto/apr_sha1.c
Modified: apr/apr-util/branches/1.4.x/CHANGES
URL: http://svn.apache.org/viewvc/apr/apr-util/branches/1.4.x/CHANGES?rev=731414&r1=731413&r2=731414&view=diff
==============================================================================
--- apr/apr-util/branches/1.4.x/CHANGES [utf-8] (original)
+++ apr/apr-util/branches/1.4.x/CHANGES [utf-8] Sun Jan 4 18:19:27 2009
@@ -1,6 +1,9 @@
-*- coding: utf-8 -*-
Changes with APR-util 1.4.0
+ *) Fix a buffer overrun and password matching for SHA passwords.
+ PR 45679 [Ben Noordhuis <bnoordhuis gmail.com>]
+
*) Fix the saving of the old LIBS, CPPFLAGS and LDFLAGS when OpenSSL
and NSS are detected. [Graham Leggett, Ruediger Pluem]
Modified: apr/apr-util/branches/1.4.x/crypto/apr_sha1.c
URL: http://svn.apache.org/viewvc/apr/apr-util/branches/1.4.x/crypto/apr_sha1.c?rev=731414&r1=731413&r2=731414&view=diff
==============================================================================
--- apr/apr-util/branches/1.4.x/crypto/apr_sha1.c (original)
+++ apr/apr-util/branches/1.4.x/crypto/apr_sha1.c Sun Jan 4 18:19:27 2009
@@ -351,10 +351,6 @@
apr_sha1_ctx_t context;
apr_byte_t digest[APR_SHA1_DIGESTSIZE];
- if (strncmp(clear, APR_SHA1PW_ID, APR_SHA1PW_IDLEN) == 0) {
- clear += APR_SHA1PW_IDLEN;
- }
-
apr_sha1_init(&context);
apr_sha1_update(&context, clear, len);
apr_sha1_final(digest, &context);