X-Git-Url: http://andersk.mit.edu/gitweb/gssapi-openssh.git/blobdiff_plain/7cac2b656d969b64094f20b40ddcaca5ac1ca924..cdaf3e9d646e031c9354e0f6056c869263085379:/openssh/auth2-passwd.c

diff --git a/openssh/auth2-passwd.c b/openssh/auth2-passwd.c
index 67fb4c9..421c5c2 100644
--- a/openssh/auth2-passwd.c
+++ b/openssh/auth2-passwd.c
@@ -1,3 +1,4 @@
+/* $OpenBSD: auth2-passwd.c,v 1.9 2006/08/03 03:34:41 deraadt Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -23,12 +24,22 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth2-passwd.c,v 1.4 2003/08/26 09:58:43 markus Exp $");
+
+#include <sys/types.h>
+
+#include <string.h>
+#include <stdarg.h>
 
 #include "xmalloc.h"
 #include "packet.h"
 #include "log.h"
+#include "key.h"
+#include "hostfile.h"
 #include "auth.h"
+#include "buffer.h"
+#ifdef GSSAPI
+#include "ssh-gss.h"
+#endif
 #include "monitor_wrap.h"
 #include "servconf.h"
 
@@ -38,21 +49,29 @@ extern ServerOptions options;
 static int
 userauth_passwd(Authctxt *authctxt)
 {
-	char *password;
+	char *password, *newpass;
 	int authenticated = 0;
 	int change;
-	u_int len;
+	u_int len, newlen;
+
 	change = packet_get_char();
-	if (change)
-		logit("password change not supported");
 	password = packet_get_string(&len);
+	if (change) {
+		/* discard new password from packet */
+		newpass = packet_get_string(&newlen);
+		memset(newpass, 0, newlen);
+		xfree(newpass);
+	}
 	packet_check_eom();
-	if (PRIVSEP(auth_password(authctxt, password)) == 1
+
+	if (change)
+		logit("password change not supported");
+	else if (PRIVSEP(auth_password(authctxt, password)) == 1)
+		authenticated = 1;
 #ifdef HAVE_CYGWIN
-	    && check_nt_auth(1, authctxt->pw)
+	if (check_nt_auth(1, authctxt->pw) == 0)
+		authenticated = 0;
 #endif
-	    )
-		authenticated = 1;
 	memset(password, 0, len);
 	xfree(password);
 	return authenticated;