diff --git a/passwd-0.79-stdin-length.patch b/passwd-0.79-stdin-length.patch new file mode 100644 index 0000000..0d9f77e --- /dev/null +++ b/passwd-0.79-stdin-length.patch @@ -0,0 +1,40 @@ +Support passwords up to PAM_MAX_RESP_SIZE - 1 with --stdin + +diff -r a3adceb0d42d -r 41908bb68e45 passwd.c +--- a/passwd.c Sat May 23 06:52:54 2015 +0200 ++++ b/passwd.c Mon Nov 02 19:20:24 2015 +0100 +@@ -479,17 +479,32 @@ + /* If we need to read the new password from stdin, read it and switch + * to the really-quiet stdin conversation function. */ + if (passwd_flags & PASSWD_STDIN) { +- char *ptr, newPassword[80]; ++ /* PAM's documentation says that PAM_MAX_RESP_SIZE is the ++ * maximum supported length of the password, but in practice ++ * the code (including examples in the OSF RFC) often truncates ++ * data at PAM_MAX_RESP_SIZE - 1. So, refuse to use anything ++ * longer than PAM_MAX_RESP_SIZE - 1, to prevent users from ++ * setting a password they won't be able to use to log in. */ ++ char *ptr, newPassword[PAM_MAX_RESP_SIZE]; + int i; + + i = read(STDIN_FILENO, newPassword, +- sizeof(newPassword) - 1); ++ sizeof(newPassword)); + if (i < 0) { + fprintf(stderr, + _("%s: error reading from stdin: %s\n"), progname, + strerror(errno)); + exit(1); + } ++ if (i == sizeof(newPassword)) { ++ if (newPassword[i - 1] != '\n') { ++ fprintf(stderr, ++ _("%s: password too long, maximum is %zu"), ++ progname, sizeof(newPassword) - 1); ++ exit(1); ++ } ++ i--; ++ } + + newPassword[i] = '\0'; + ptr = strchr(newPassword, '\n'); diff --git a/passwd.spec b/passwd.spec index 3ac23ee..a437dbc 100644 --- a/passwd.spec +++ b/passwd.spec @@ -7,11 +7,13 @@ Summary: An utility for setting or changing passwords using PAM Name: passwd Version: 0.79 -Release: 6%{?dist} +Release: 7%{?dist} License: BSD or GPL+ Group: System Environment/Base URL: http://fedorahosted.org/passwd Source: https://fedorahosted.org/releases/p/a/%{name}/%{name}-%{version}.tar.bz2 +# Upstream changeset 41908bb68e4590aa6a5434eb979b23a9f8828011 +Patch0: passwd-0.79-stdin-length.patch Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: pam >= 1.0.90, /etc/pam.d/system-auth %if %{WITH_SELINUX} @@ -32,6 +34,7 @@ Modules) library. %prep %setup -q -n %{name}-%{version} +%patch0 -p1 -b .stdin-length %build %configure \ @@ -74,6 +77,10 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man1/passwd.1* %changelog +* Mon Nov 2 2015 Miloslav Trmač - 0.79-7 +- Support passwords up to PAM_MAX_RESP_SIZE - 1 with --stdin + Resolves: #1187105 + * Thu Jun 18 2015 Fedora Release Engineering - 0.79-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild