summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2006-10-23 06:06:35 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 14:21:37 -0500
commit95424817274295c56da3d3a5dc1ba3b2d75b0f8d (patch)
tree3894ecda4eb0c817b546e33d5fb16b97eddbc88f
parent5bfc0d63170521ad8d451ffcfbb30ee5b140dfbb (diff)
downloadsamba-95424817274295c56da3d3a5dc1ba3b2d75b0f8d.tar.gz
samba-95424817274295c56da3d3a5dc1ba3b2d75b0f8d.tar.bz2
samba-95424817274295c56da3d3a5dc1ba3b2d75b0f8d.zip
r19464: Reject passwords that cannot be converted into UCS2.
Andrew Bartlett (This used to be commit c843fce7a0e9b91c4d2de44e7a9ad9599b33ec5c)
-rw-r--r--source4/dsdb/samdb/samdb.c8
-rw-r--r--source4/libcli/auth/smbencrypt.c10
2 files changed, 15 insertions, 3 deletions
diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index e6752716ab..506c17a5fd 100644
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -1249,7 +1249,13 @@ _PUBLIC_ NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ct
if (E_deshash(new_pass, local_lmNewHash.hash)) {
lmNewHash = &local_lmNewHash;
}
- E_md4hash(new_pass, local_ntNewHash.hash);
+ if (!E_md4hash(new_pass, local_ntNewHash.hash)) {
+ /* If we can't convert this password to UCS2, then we should not accept it */
+ if (reject_reason) {
+ *reject_reason = SAMR_REJECT_OTHER;
+ }
+ return NT_STATUS_PASSWORD_RESTRICTION;
+ }
ntNewHash = &local_ntNewHash;
}
diff --git a/source4/libcli/auth/smbencrypt.c b/source4/libcli/auth/smbencrypt.c
index 67da795a44..296d44f5d4 100644
--- a/source4/libcli/auth/smbencrypt.c
+++ b/source4/libcli/auth/smbencrypt.c
@@ -63,18 +63,24 @@ BOOL SMBencrypt(const char *passwd, const uint8_t *c8, uint8_t p24[24])
* @param p16 return password hashed with md4, caller allocated 16 byte buffer
*/
-void E_md4hash(const char *passwd, uint8_t p16[16])
+BOOL E_md4hash(const char *passwd, uint8_t p16[16])
{
int len;
void *wpwd;
len = push_ucs2_talloc(NULL, &wpwd, passwd);
- SMB_ASSERT(len >= 2);
+ if (len < 2) {
+ /* We don't want to return fixed data, as most callers
+ * don't check */
+ mdfour(p16, passwd, strlen(passwd));
+ return False;
+ }
len -= 2;
mdfour(p16, wpwd, len);
talloc_free(wpwd);
+ return True;
}
/**