mirror of https://github.com/wolfSSL/wolfssh.git
The password backends check the password as a C string, so "\0junk" was checked as "" while its nonzero length passed the PermitEmptyPasswords check. RequestAuthentication now refuses any password with a NUL before the policy check and the backends. - test_RequestAuth_embeddedNulPasswordRejected puts the NUL first, last and mid-password, and checks the fake crypt still runs Issue: F-16096 |
||
|---|---|---|
| .. | ||
| wolfssh | ||
| wolfsshd | ||
| include.am | ||
| wolfssh-options.c | ||