[Bug 10441] accidental full text password expose to local users possible

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=10441

--- Comment #1 from surae at yandex.ru ---
loginutils/login.c:522:
...
auth_failed:                                                                 
                opt &= ~LOGIN_OPT_f;                                          
                bb_do_delay(LOGIN_FAIL_DELAY);                                  
                /* TODO: doesn't sound like correct English phrase to me */   
                puts("Login incorrect");                                        
                if (++count == 3) {                                            
                        syslog(LOG_WARNING, "invalid password for '%s'%s",      
                                                username, fromhost);            

                        if (ENABLE_FEATURE_CLEAN_UP)                          
                                free(fromhost);                               

                        return EXIT_FAILURE;                                  
                }                                                             
                username[0] = '\0';                                             
        } /* while (1) */               
...

I guess, where is no sense in "if (++count == 3) { " on string 527. It saves no
resource and used extrimely rare, afaik.

-- 
You are receiving this mail because:
You are on the CC list for the bug.