commit: facfcc2e69ac04433cb0b9b31b755d9e9fb20b2b Author: Mike Gilbert <floppym <AT> gentoo <DOT> org> AuthorDate: Sun Aug 15 00:46:26 2021 +0000 Commit: Mike Gilbert <floppym <AT> gentoo <DOT> org> CommitDate: Sun Aug 15 00:46:26 2021 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=facfcc2e
sys-apps/shadow: fix SHA hash behavior with USE=-pam Closes: https://bugs.gentoo.org/808195 Signed-off-by: Mike Gilbert <floppym <AT> gentoo.org> sys-apps/shadow/files/shadow-4.9-SHA-rounds.patch | 57 ++++++++++++++++++++++ .../{shadow-4.9-r1.ebuild => shadow-4.9-r2.ebuild} | 1 + 2 files changed, 58 insertions(+) diff --git a/sys-apps/shadow/files/shadow-4.9-SHA-rounds.patch b/sys-apps/shadow/files/shadow-4.9-SHA-rounds.patch new file mode 100644 index 00000000000..05be7adc1b1 --- /dev/null +++ b/sys-apps/shadow/files/shadow-4.9-SHA-rounds.patch @@ -0,0 +1,57 @@ +From 234e8fa7b134d1ebabfdad980a3ae5b63c046c62 Mon Sep 17 00:00:00 2001 +From: Mike Gilbert <flop...@gentoo.org> +Date: Sat, 14 Aug 2021 13:24:34 -0400 +Subject: [PATCH] libmisc: fix default value in SHA_get_salt_rounds() + +If SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS are both unspecified, +use SHA_ROUNDS_DEFAULT. + +Previously, the code fell through, calling shadow_random(-1, -1). This +ultimately set rounds = (unsigned long) -1, which ends up being a very +large number! This then got capped to SHA_ROUNDS_MAX later in the +function. + +The new behavior matches BCRYPT_get_salt_rounds(). + +Bug: https://bugs.gentoo.org/808195 +Fixes: https://github.com/shadow-maint/shadow/issues/393 +--- + libmisc/salt.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/libmisc/salt.c b/libmisc/salt.c +index 91d528fd..30eefb9c 100644 +--- a/libmisc/salt.c ++++ b/libmisc/salt.c +@@ -223,20 +223,21 @@ static /*@observer@*/const unsigned long SHA_get_salt_rounds (/*@null@*/int *pre + if ((-1 == min_rounds) && (-1 == max_rounds)) { + rounds = SHA_ROUNDS_DEFAULT; + } ++ else { ++ if (-1 == min_rounds) { ++ min_rounds = max_rounds; ++ } + +- if (-1 == min_rounds) { +- min_rounds = max_rounds; +- } ++ if (-1 == max_rounds) { ++ max_rounds = min_rounds; ++ } + +- if (-1 == max_rounds) { +- max_rounds = min_rounds; +- } ++ if (min_rounds > max_rounds) { ++ max_rounds = min_rounds; ++ } + +- if (min_rounds > max_rounds) { +- max_rounds = min_rounds; ++ rounds = (unsigned long) shadow_random (min_rounds, max_rounds); + } +- +- rounds = (unsigned long) shadow_random (min_rounds, max_rounds); + } else if (0 == *prefered_rounds) { + rounds = SHA_ROUNDS_DEFAULT; + } else { diff --git a/sys-apps/shadow/shadow-4.9-r1.ebuild b/sys-apps/shadow/shadow-4.9-r2.ebuild similarity index 99% rename from sys-apps/shadow/shadow-4.9-r1.ebuild rename to sys-apps/shadow/shadow-4.9-r2.ebuild index 545c8cb652b..8ce94660aad 100644 --- a/sys-apps/shadow/shadow-4.9-r1.ebuild +++ b/sys-apps/shadow/shadow-4.9-r2.ebuild @@ -57,6 +57,7 @@ PATCHES=( "${FILESDIR}/${P}-libsubid_pam_linking.patch" "${FILESDIR}/${P}-libsubid_oot_build.patch" "${FILESDIR}/shadow-4.9-libcrack.patch" + "${FILESDIR}/shadow-4.9-SHA-rounds.patch" ) src_prepare() {
