bughz/3proxy
1
0
Fork 0
mirror of https://github.com/3proxy/3proxy.git synced 2026-07-26 05:00:11 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix: short CL cleartext passwords failed authentication

Browse Source 
strongauth() compared short CL passwords over pwl_table.recsize-1 bytes,
reading past the client password buffer (strdup of pwlen+1) and rejecting
valid passwords whenever trailing heap bytes were non-zero. Zero-pad the
provided password to the record width and compare in constant time, like
the long-password BLAKE2 path.

Fixes #1254
This commit is contained in:
Nirmal Khanal 2026-07-24 15:00:00 +03:00 committed by Vladimir Dubrovin
parent c60af54c98
commit 75dedeff28
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/auth.c
View File

@ -247,7 +247,9 @@ int strongauth(struct clientparam * param){
int pwlen = strlen((char *)param->password);
if(pwlen > 255) pwlen = 255;
if((unsigned)pwlen < pwl_table.recsize) {
if(strlen(pass + 1) == strlen((char *)param->password) && !ctmemcmp(pass + 1, param->password, pwl_table.recsize - 1)) return 0;
memset(buf, 0, pwl_table.recsize - 1);
memcpy(buf, param->password, pwlen);
if(!ctmemcmp(pass + 1, buf, pwl_table.recsize - 1)) return 0;
} else {
mdh_ctx *bctx;
unsigned hashsz;