tree 004786f62fcd19069225c2b26d8d34675655da25
parent db2933f56171a2999dabcb3499857f65bc15f850
author Andrew Langefeld <andrew.langefeld@adtran.com> 1528761104 -0500
committer Andrew Langefeld <andrew.langefeld@adtran.com> 1528761104 -0500

Fix segfault when crypt() returns NULL

`crypt()` and `crypt_r()` can return `NULL` when an error is encountered.
For example, if a user has been locked using `usermod -L`, queries to the
password database can return an encrypted password prefixed by `!`, and
`crypt()` will return `NULL` because the password hash is malformed.

This change prevents `auth_password_compare_pwd()` from dereferencing
a NULL pointer if `crypt()` or `crypt_r()` returns NULL due to an error.
Instead, we now return nonzero in this case (i.e., authentication failed).