svn commit: r731415 - in /apr/apr-util/branches/1.3.x: CHANGES crypto/apr_sha1.c

[bo...@apache.org]

Author: bojan
Date: Sun Jan  4 18:20:27 2009
New Revision: 731415

URL: http://svn.apache.org/viewvc?rev=731415&view=rev
Log:
Backport r731413 from the trunk.
Fix a buffer overrun and password matching for SHA passwords.
PR 45679.
Patch by Ben Noordhuis <bnoordhuis gmail.com>.

Modified:
    apr/apr-util/branches/1.3.x/CHANGES
    apr/apr-util/branches/1.3.x/crypto/apr_sha1.c

Modified: apr/apr-util/branches/1.3.x/CHANGES
URL: http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/CHANGES?rev=731415&r1=731414&r2=731415&view=diff
==============================================================================
--- apr/apr-util/branches/1.3.x/CHANGES [utf-8] (original)
+++ apr/apr-util/branches/1.3.x/CHANGES [utf-8] Sun Jan  4 18:20:27 2009
@@ -1,6 +1,9 @@
                                                      -*- coding: utf-8 -*-
 Changes with APR-util 1.3.5
 
+  *) Fix a buffer overrun and password matching for SHA passwords.
+     PR 45679 [Ben Noordhuis <bnoordhuis gmail.com>]
+
   *) Introduce DSO handling of the db, gdbm and ndbm drivers, so these are
      loaded as .so's on first demand, unless --disable-util-dso is configured.
      [William Rowe]

Modified: apr/apr-util/branches/1.3.x/crypto/apr_sha1.c
URL: http://svn.apache.org/viewvc/apr/apr-util/branches/1.3.x/crypto/apr_sha1.c?rev=731415&r1=731414&r2=731415&view=diff
==============================================================================
--- apr/apr-util/branches/1.3.x/crypto/apr_sha1.c (original)
+++ apr/apr-util/branches/1.3.x/crypto/apr_sha1.c Sun Jan  4 18:20:27 2009
@@ -351,10 +351,6 @@
     apr_sha1_ctx_t context;
     apr_byte_t digest[APR_SHA1_DIGESTSIZE];
 
-    if (strncmp(clear, APR_SHA1PW_ID, APR_SHA1PW_IDLEN) == 0) {
-	clear += APR_SHA1PW_IDLEN;
-    }
-
     apr_sha1_init(&context);
     apr_sha1_update(&context, clear, len);
     apr_sha1_final(digest, &context);