[src/trunk]: src/lib/libcrypt avoid accessing array over its bound, from Sola...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9b9b1047e85d
branches:  trunk
changeset: 772251:9b9b1047e85d
user:      christos <christos%NetBSD.org@localhost>
date:      Mon Dec 26 16:03:42 2011 +0000

description:
avoid accessing array over its bound, from Solar Designer

diffstat:

 lib/libcrypt/crypt.c |  9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diffs (37 lines):

diff -r dba1902e8cd1 -r 9b9b1047e85d lib/libcrypt/crypt.c
--- a/lib/libcrypt/crypt.c      Mon Dec 26 14:51:20 2011 +0000
+++ b/lib/libcrypt/crypt.c      Mon Dec 26 16:03:42 2011 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: crypt.c,v 1.28 2009/05/01 00:28:17 perry Exp $ */
+/*     $NetBSD: crypt.c,v 1.29 2011/12/26 16:03:42 christos Exp $      */
 
 /*
  * Copyright (c) 1989, 1993
@@ -37,7 +37,7 @@
 #if 0
 static char sccsid[] = "@(#)crypt.c    8.1.1.1 (Berkeley) 8/18/93";
 #else
-__RCSID("$NetBSD: crypt.c,v 1.28 2009/05/01 00:28:17 perry Exp $");
+__RCSID("$NetBSD: crypt.c,v 1.29 2011/12/26 16:03:42 christos Exp $");
 #endif
 #endif /* not lint */
 
@@ -532,7 +532,8 @@
                        if ((t = (unsigned char)setting[i]) == '\0')
                                t = '.';
                        encp[i] = t;
-                       num_iter = (num_iter<<6) | a64toi[t];
+                       num_iter = (num_iter << 6) |
+                           a64toi[t & (sizeof(a64toi) - 1)];
                }
                setting += 4;
                encp += 4;
@@ -548,7 +549,7 @@
                if ((t = (unsigned char)setting[i]) == '\0')
                        t = '.';
                encp[i] = t;
-               salt = (salt<<6) | a64toi[t];
+               salt = (salt<<6) | a64toi[t & (sizeof(a64toi) - 1)];
        }
        encp += salt_size;
        if (des_cipher((char *)(void *)&constdatablock,