Merge pull request #418 from botovq/push-vzwkspvpmqvu

challengeauth_response (): move digest to stack
This commit is contained in:
deepend-tildeclub
2026-10-13 18:13:15 -07:00
committed by GitHub
2 changed files with 12 additions and 2 deletions
+5
View File
@@ -1288,6 +1288,11 @@ process_named_msg (session *sess, char *type, char *word[], char *word_eol[],
char *user = net && net->user ? net->user : prefs.hex_irc_user_name;
response = challengeauth_response (user, serv->password, word[5]);
if (response == NULL)
{
PrintTextf (serv->server_session, _("Error building CHALLENGEAUTH for %s"), user);
return;
}
tcp_sendf (serv, "PRIVMSG %s :CHALLENGEAUTH %s %s %s\r\n",
CHALLENGEAUTH_NICK,
+7 -2
View File
@@ -1453,7 +1453,7 @@ challengeauth_response (const char *username, const char *password, const char *
char *passhash;
char *key;
char *keyhash;
unsigned char *digest;
unsigned char digest[SHA256_DIGEST_LENGTH];
GString *buf = g_string_new_len (NULL, SHA256_DIGEST_LENGTH * 2);
user = rfc_strlower (username); /* convert username to lowercase as per the RFC */
@@ -1469,7 +1469,12 @@ challengeauth_response (const char *username, const char *password, const char *
keyhash = str_sha256hash (key);
g_free (key);
digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL);
if (HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), digest, NULL) == NULL)
{
g_free (keyhash);
g_string_free (buf, TRUE);
return NULL;
}
g_free (keyhash);
for (i = 0; i < SHA256_DIGEST_LENGTH; i++)