BUG/MEDIUM: auth: fix segfault with http-auth and a configuration with an unknown...

Grégoire Morpain reported a segfault when a secured password is used for http
authentication. It was caused by the use of an unsupported encryption algorithm
with libcrypto. In this case, crypt() returns a NULL pointer.

The fix should be backported to 1.4 and 1.5.

diff --git a/src/auth.c b/src/auth.c
index 1069c5b..42c0808 100644 (file)
--- a/src/auth.c
+++ b/src/auth.c
@@ -252,7 +252,7 @@ check_user(struct userlist *ul, const char *user, const char *pass)
        fprintf(stderr, ", crypt=%s\n", ep);
 #endif
 
-       if (!strcmp(ep, u->pass))
+       if (ep && strcmp(ep, u->pass) == 0)
                return 1;
        else
                return 0;