deon/gnuk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

More check for length of PW1.

Browse Source
This commit is contained in:
NIIBE Yutaka
2018-04-04 19:28:42 +09:00
parent b6534dceba
commit 9cfeb817bd
3 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/openpgp.c
View File

@@ -555,6 +555,7 @@ cmd_reset_user_password (void)
{
const uint8_t *ks_rc = gpg_do_read_simple (NR_DO_KEYSTRING_RC);
uint8_t old_ks[KEYSTRING_MD_SIZE];
const uint8_t *ks_pw3 = gpg_do_read_simple (NR_DO_KEYSTRING_PW3);
if (gpg_do_kdf_check (len, 2) == 0)
{
@@ -581,6 +582,16 @@ cmd_reset_user_password (void)
salt_len = SALT_SIZE;
newpw = pw + pw_len;
newpw_len = len - pw_len;
/* Check length of new password */
if ((ks_pw3 == NULL && newpw_len < ADMIN_PASSWD_MINLEN)
|| newpw_len < USER_PASSWD_MINLEN)
{
DEBUG_INFO ("new password length is too short.");
GPG_CONDITION_NOT_SATISFIED ();
return;
}
random_get_salt (new_salt);
s2k (salt, salt_len, pw, pw_len, old_ks);
s2k (new_salt, SALT_SIZE, newpw, newpw_len, new_ks);