From 9582291a9ff7961af7a4ed579a76dc3db3cae66e Mon Sep 17 00:00:00 2001
From: Ludovic Poitou <ludovic.poitou@forgerock.com>
Date: Sun, 21 Nov 2010 19:35:53 +0000
Subject: [PATCH] Update code to log a message when the base64 decoded password is smaller than expected (salt length is zero or less). Provide basic test for SHA384, and minor updates.
---
opends/src/server/org/opends/server/extensions/SaltedSHA384PasswordStorageScheme.java | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/opends/src/server/org/opends/server/extensions/SaltedSHA384PasswordStorageScheme.java b/opends/src/server/org/opends/server/extensions/SaltedSHA384PasswordStorageScheme.java
index d2cc809..ebbb8bd 100644
--- a/opends/src/server/org/opends/server/extensions/SaltedSHA384PasswordStorageScheme.java
+++ b/opends/src/server/org/opends/server/extensions/SaltedSHA384PasswordStorageScheme.java
@@ -284,6 +284,14 @@
byte[] decodedBytes = Base64.decode(storedPassword.toString());
saltLength = decodedBytes.length - SHA384_LENGTH;
+ if (saltLength <= 0)
+ {
+ Message message =
+ ERR_PWSCHEME_INVALID_BASE64_DECODED_STORED_PASSWORD.get(
+ storedPassword.toString());
+ ErrorLogger.logError(message);
+ return false;
+ }
saltBytes = new byte[saltLength];
System.arraycopy(decodedBytes, 0, digestBytes, 0, SHA384_LENGTH);
System.arraycopy(decodedBytes, SHA384_LENGTH, saltBytes, 0,
--
Gitblit v1.10.0