fixed crash when bogus payload (auth_data == NULL) was received.

[silc.git] / lib / silccore / silcauth.c

diff --git a/lib/silccore/silcauth.c b/lib/silccore/silcauth.c
index b3fb455891707f1efc0f250078a14cf40a675616..73da54044d3124dc564c82252ad24bad4a05bc06 100644 (file)
--- a/lib/silccore/silcauth.c
+++ b/lib/silccore/silcauth.c
@@ -208,7 +208,7 @@ silc_auth_public_key_encode_data(SilcPublicKey public_key,
 
 SilcBuffer silc_auth_public_key_auth_generate(SilcPublicKey public_key,
                                              SilcPrivateKey private_key,
-                                             SilcHash hash,
+                                             SilcRng rng, SilcHash hash,
                                              const void *id, SilcIdType type)
 {
   unsigned char *random;
@@ -222,7 +222,10 @@ SilcBuffer silc_auth_public_key_auth_generate(SilcPublicKey public_key,
   SILC_LOG_DEBUG(("Generating Authentication Payload with data"));
 
   /* Get 256 bytes of random data */
-  random = silc_rng_global_get_rn_data(256);
+  if (rng)
+    random = silc_rng_get_rn_data(rng, 256);
+  else
+    random = silc_rng_global_get_rn_data(256);
   if (!random)
     return NULL;
   
@@ -366,8 +369,17 @@ bool silc_auth_verify(SilcAuthPayload payload, SilcAuthMethod auth_method,
   case SILC_AUTH_PASSWORD:
     /* Passphrase based authentication. The `pkcs', `hash', `id' and `type'
        arguments are not needed. */
+    /* Carefully check that the auth_data field of the payload is not empty
+       (len=0), which seems to be a legal packet but would crash the
+       application. Maybe such packet should be dropped. -Johnny 2002/14/4 */
+    if ((payload->auth_len == 0) || !auth_data)
+      break;
+
+    /* if lengths mismatch, avoid comparing unallocated memory locations */
+    if (payload->auth_len != auth_data_len)
+      break;
     if (!memcmp(payload->auth_data, auth_data, auth_data_len)) {
-      SILC_LOG_DEBUG(("Authentication successful"));
+      SILC_LOG_DEBUG(("Passphrase Authentication successful"));
       return TRUE;
     }
     break;