Vladimir N. Oleynik writes:

    This moment have algoritmicaly problem, not overflow:
    strcat(wrapped, wrapped) - may be looped.

    Hand patch:

    - else if (strstr(strcat(wrapped, wrapped), newmono))
    + else {
    +    safe_strncpy(wrapped + lenwrap, wrapped, lenwrap + 1);
    +    if (strstr(wrapped, newmono))
    +}

    --w
    vodz


git-svn-id: svn://busybox.net/trunk/busybox@7137 69ca8d6d-28ef-0310-b511-8ec308f3f277

1 files changed, 5 insertions, 2 deletions

diff --git a/libbb/obscure.c b/libbb/obscure.c
index 1a99b7cf9..537d4484f 100644
--- a/libbb/obscure.c
+++ b/libbb/obscure.c
@@ -157,8 +157,11 @@ password_check(const char *old, const char *newval, const struct passwd *pwdp)
         else if (similiar(wrapped, newmono))
                 msg = "too similiar";
 
-        else if (strstr(strcat(wrapped, wrapped), newmono))
-                msg = "rotated";
+        else {
+                safe_strncpy(wrapped + lenwrap, wrapped, lenwrap + 1);
+                if (strstr(wrapped, newmono))
+                        msg = "rotated";
+        }
 
         bzero(newmono, strlen(newmono));
         bzero(wrapped, lenwrap);