r19464: Reject passwords that cannot be converted into UCS2.

Andrew Bartlett
(This used to be commit c843fce7a0e9b91c4d2de44e7a9ad9599b33ec5c)

diff --git a/source4/dsdb/samdb/samdb.c b/source4/dsdb/samdb/samdb.c
index e6752716ab0e46aef11e7e740242978ca8d30864..506c17a5fd26646ee16a166e144849691df62685 100644 (file)
--- a/source4/dsdb/samdb/samdb.c
+++ b/source4/dsdb/samdb/samdb.c
@@ -1249,7 +1249,13 @@ _PUBLIC_ NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ct
                if (E_deshash(new_pass, local_lmNewHash.hash)) {
                        lmNewHash = &local_lmNewHash;
                }
-               E_md4hash(new_pass, local_ntNewHash.hash);
+               if (!E_md4hash(new_pass, local_ntNewHash.hash)) {
+                       /* If we can't convert this password to UCS2, then we should not accept it */
+                       if (reject_reason) {
+                               *reject_reason = SAMR_REJECT_OTHER;
+                       }
+                       return NT_STATUS_PASSWORD_RESTRICTION;
+               }
                ntNewHash = &local_ntNewHash;
        }
 

diff --git a/source4/libcli/auth/smbencrypt.c b/source4/libcli/auth/smbencrypt.c
index 67da795a44b34889db363bff3ce56d0e43effe37..296d44f5d4f71f2187bb3e51e87694ed6cbf4d5c 100644 (file)
--- a/source4/libcli/auth/smbencrypt.c
+++ b/source4/libcli/auth/smbencrypt.c
@@ -63,18 +63,24 @@ BOOL SMBencrypt(const char *passwd, const uint8_t *c8, uint8_t p24[24])
  * @param p16 return password hashed with md4, caller allocated 16 byte buffer
  */
  
-void E_md4hash(const char *passwd, uint8_t p16[16])
+BOOL E_md4hash(const char *passwd, uint8_t p16[16])
 {
        int len;
        void *wpwd;
 
        len = push_ucs2_talloc(NULL, &wpwd, passwd);
-       SMB_ASSERT(len >= 2);
+       if (len < 2) {
+               /* We don't want to return fixed data, as most callers
+                * don't check */
+               mdfour(p16, passwd, strlen(passwd));
+               return False;
+       }
        
        len -= 2;
        mdfour(p16, wpwd, len);
 
        talloc_free(wpwd);
+       return True;
 }
 
 /**