From 9040300eec29e8427a3f35a0ab227f14766b6fc0 Mon Sep 17 00:00:00 2001
From: Ludovic Poitou <ludovic.poitou@forgerock.com>
Date: Sun, 21 Nov 2010 19:35:53 +0000
Subject: [PATCH] Update code to log a message when the base64 decoded password is smaller than expected (salt length is zero or less). Provide basic test for SHA384, and minor updates.
---
opendj-sdk/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java | 9 +++++++++
1 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/opendj-sdk/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java b/opendj-sdk/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
index e986365..49bd575 100644
--- a/opendj-sdk/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
+++ b/opendj-sdk/opends/src/server/org/opends/server/extensions/SaltedSHA1PasswordStorageScheme.java
@@ -23,6 +23,7 @@
*
*
* Copyright 2006-2010 Sun Microsystems, Inc.
+ * Portions Copyright 2010 ForgeRock AS.
*/
package org.opends.server.extensions;
@@ -278,6 +279,14 @@
byte[] decodedBytes = Base64.decode(storedPassword.toString());
saltLength = decodedBytes.length - SHA1_LENGTH;
+ if (saltLength <= 0)
+ {
+ Message message =
+ ERR_PWSCHEME_INVALID_BASE64_DECODED_STORED_PASSWORD.get(
+ storedPassword.toString());
+ ErrorLogger.logError(message);
+ return false;
+ }
saltBytes = new byte[saltLength];
System.arraycopy(decodedBytes, 0, digestBytes, 0, SHA1_LENGTH);
System.arraycopy(decodedBytes, SHA1_LENGTH, saltBytes, 0,
--
Gitblit v1.10.0