aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDuncaen <mail@duncano.de>2019-01-30 23:17:49 +0100
committerDuncaen <mail@duncano.de>2019-01-30 23:29:32 +0100
commita283d2f0e2569329bd13f97d2d61f7556ea51b30 (patch)
treef60c4855db970ef3e8ad4ee66c68b86ef4688272
parent37bd6612bdffabe6d8a588b391bd353c39497abb (diff)
downloadopendoas-a283d2f0e2569329bd13f97d2d61f7556ea51b30.tar.gz
shadow: clear the password even after a mismatch
-rw-r--r--shadow.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/shadow.c b/shadow.c
index a775b2b..53877d5 100644
--- a/shadow.c
+++ b/shadow.c
@@ -64,9 +64,14 @@ shadowauth(const char *myname, int persist)
"tty required for %s", myname);
errx(1, "a tty is required");
}
- if ((encrypted = crypt(response, hash)) == NULL)
- err(1, "crypt");
+ if (response == NULL)
+ err(1, "readpassphrase");
+ if ((encrypted = crypt(response, hash)) == NULL) {
+ explicit_bzero(rbuf, sizeof(rbuf));
+ errx(1, "Authorization failed");
+ }
if (strcmp(encrypted, hash) != 0) {
+ explicit_bzero(rbuf, sizeof(rbuf));
syslog(LOG_AUTHPRIV | LOG_NOTICE, "failed auth for %s", myname);
errx(1, "Authorization failed");
}