diff options
| author | Nathaniel McCallum <npmccallum@redhat.com> | 2015-04-27 10:23:49 -0400 |
|---|---|---|
| committer | Petr Vobornik <pvoborni@redhat.com> | 2015-05-05 11:50:20 +0200 |
| commit | 978298882b06dcf8a86a8d6ec60d7f1266aac697 (patch) | |
| tree | 2bcac01049e0207b42e6b242b8aef60c9636485a /daemons | |
| parent | 81df7b501e9adca119f671a6466a52a9e38503f2 (diff) | |
| download | freeipa-978298882b06dcf8a86a8d6ec60d7f1266aac697.tar.gz freeipa-978298882b06dcf8a86a8d6ec60d7f1266aac697.tar.xz freeipa-978298882b06dcf8a86a8d6ec60d7f1266aac697.zip | |
Fix a signedness bug in OTP code
This bug caused negative token windows to wrap-around, causing issues
with TOTP authentication and (especially) synchronization.
https://fedorahosted.org/freeipa/ticket/4990
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Diffstat (limited to 'daemons')
| -rw-r--r-- | daemons/ipa-slapi-plugins/libotp/otp_token.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/daemons/ipa-slapi-plugins/libotp/otp_token.c b/daemons/ipa-slapi-plugins/libotp/otp_token.c index bc6acc42c..9b90c6a11 100644 --- a/daemons/ipa-slapi-plugins/libotp/otp_token.c +++ b/daemons/ipa-slapi-plugins/libotp/otp_token.c @@ -489,7 +489,7 @@ bool otp_token_validate_berval(struct otp_token * const *tokens, if (time(&now) == (time_t) -1) return false; - for (uint32_t i = 0, cnt = 1; cnt != 0; i++) { + for (ssize_t i = 0, cnt = 1; cnt != 0; i++) { cnt = 0; for (int j = 0; tokens[j] != NULL; j++) { uint32_t *secondp = NULL; @@ -513,8 +513,8 @@ bool otp_token_validate_berval(struct otp_token * const *tokens, } /* Validate the positive/negative steps. */ - if (!validate(tokens[j], now, i, first, secondp) && - !validate(tokens[j], now, 0 - i, first, secondp)) + if (!validate(tokens[j], now, i, first, secondp) && + !validate(tokens[j], now, -i, first, secondp)) continue; /* Codes validated; strip. */ |