[dovecot-cvs] dovecot/src/auth md5crypt.c,1.2,1.3

[cras at procontrol.fi]

Update of /home/cvs/dovecot/src/auth
In directory danu:/tmp/cvs-serv13739

Modified Files:
	md5crypt.c 
Log Message:
Removed strcat stuff and did some minor tweaks.



Index: md5crypt.c
===================================================================
RCS file: /home/cvs/dovecot/src/auth/md5crypt.c,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -d -r1.2 -r1.3
--- md5crypt.c	3 Apr 2003 23:42:54 -0000	1.2
+++ md5crypt.c	25 Aug 2003 07:10:29 -0000	1.3
@@ -16,6 +16,8 @@
  */
 
 #include "lib.h"
+#include "safe-memset.h"
+#include "str.h"
 #include "md5.h"
 #include "md5crypt.h"
 
@@ -30,10 +32,10 @@
 				 */
 
 static void
-to64(char *s, unsigned long v, int n)
+to64(string_t *str, unsigned long v, int n)
 {
 	while (--n >= 0) {
-		*s++ = itoa64[v&0x3f];
+		str_append_c(str, itoa64[v&0x3f]);
 		v >>= 6;
 	}
 }
@@ -47,19 +49,20 @@
 const char *
 md5_crypt(const char *pw, const char *salt)
 {
-	char passwd[120], *p;
 	const char *sp,*ep;
 	unsigned char	final[16];
 	int sl,pl,i,j;
 	struct md5_context ctx,ctx1;
 	unsigned long l;
+	string_t *passwd;
+	size_t pw_len = strlen(pw);
 
 	/* Refine the Salt first */
 	sp = salt;
 
 	/* If it starts with the magic string, then skip that */
-	if(!strncmp(sp,magic,strlen(magic)))
-		sp += strlen(magic);
+	if (strncmp(sp, magic, sizeof(magic)-1) == 0)
+		sp += sizeof(magic)-1;
 
 	/* It stops at the first '$', max 8 chars */
 	for(ep=sp;*ep && *ep != '$' && ep < (sp+8);ep++)
@@ -71,37 +74,38 @@
 	md5_init(&ctx);
 
 	/* The password first, since that is what is most unknown */
-	md5_update(&ctx,pw,strlen(pw));
+	md5_update(&ctx,pw,pw_len);
 
 	/* Then our magic string */
-	md5_update(&ctx,magic,strlen(magic));
+	md5_update(&ctx,magic,sizeof(magic)-1);
 
 	/* Then the raw salt */
 	md5_update(&ctx,sp,sl);
 
 	/* Then just as many characters of the MD5(pw,salt,pw) */
 	md5_init(&ctx1);
-	md5_update(&ctx1,pw,strlen(pw));
+	md5_update(&ctx1,pw,pw_len);
 	md5_update(&ctx1,sp,sl);
-	md5_update(&ctx1,pw,strlen(pw));
+	md5_update(&ctx1,pw,pw_len);
 	md5_final(&ctx1,final);
-	for(pl = strlen(pw); pl > 0; pl -= 16)
+	for(pl = pw_len; pl > 0; pl -= 16)
 		md5_update(&ctx,final,pl>16 ? 16 : pl);
 
 	/* Don't leave anything around in vm they could use. */
-	memset(final,0,sizeof final);
+	safe_memset(final, 0, sizeof(final));
 
 	/* Then something really weird... */
-	for (j=0,i = strlen(pw); i ; i >>= 1)
+	for (j=0,i = pw_len; i ; i >>= 1)
 		if(i&1)
 		    md5_update(&ctx, final+j, 1);
 		else
 		    md5_update(&ctx, pw+j, 1);
 
 	/* Now make the output string */
-	strcpy(passwd,magic);
-	strncat(passwd,sp,sl);
-	strcat(passwd,"$");
+	passwd = t_str_new(sl + 64);
+	str_append(passwd, magic);
+	str_append_n(passwd, sp, sl);
+	str_append_c(passwd, '$');
 
 	md5_final(&ctx,final);
 
@@ -113,7 +117,7 @@
 	for(i=0;i<1000;i++) {
 		md5_init(&ctx1);
 		if(i & 1)
-			md5_update(&ctx1,pw,strlen(pw));
+			md5_update(&ctx1,pw,pw_len);
 		else
 			md5_update(&ctx1,final,16);
 
@@ -121,27 +125,24 @@
 			md5_update(&ctx1,sp,sl);
 
 		if(i % 7)
-			md5_update(&ctx1,pw,strlen(pw));
+			md5_update(&ctx1,pw,pw_len);
 
 		if(i & 1)
 			md5_update(&ctx1,final,16);
 		else
-			md5_update(&ctx1,pw,strlen(pw));
+			md5_update(&ctx1,pw,pw_len);
 		md5_final(&ctx1,final);
 	}
 
-	p = passwd + strlen(passwd);
-
-	l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p,l,4); p += 4;
-	l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p,l,4); p += 4;
-	l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p,l,4); p += 4;
-	l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p,l,4); p += 4;
-	l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p,l,4); p += 4;
-	l =                    final[11]                ; to64(p,l,2); p += 2;
-	*p = '\0';
+	l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(passwd,l,4);
+	l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(passwd,l,4);
+	l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(passwd,l,4);
+	l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(passwd,l,4);
+	l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(passwd,l,4);
+	l =                    final[11]                ; to64(passwd,l,2);
 
 	/* Don't leave anything around in vm they could use. */
-	memset(final,0,sizeof final);
+	safe_memset(final, 0, sizeof(final));
 
-	return t_strdup(passwd);
+	return str_c(passwd);
 }