From 7dcf0a66fdcd098fb6f8700712595bbaeb4e3cbf Mon Sep 17 00:00:00 2001 From: Georgi Kodinov Date: Fri, 6 Apr 2012 12:04:07 +0300 Subject: Bug #13934049: 64884: LOGINS WITH INCORRECT PASSWORD ARE ALLOWED Fixed an improper type conversion on return that can make the server accept logins with a wrong password. --- sql/password.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sql/password.c') diff --git a/sql/password.c b/sql/password.c index e9e81fb7bf3..e029ba51fc4 100644 --- a/sql/password.c +++ b/sql/password.c @@ -531,7 +531,7 @@ check_scramble(const char *scramble_arg, const char *message, mysql_sha1_reset(&sha1_context); mysql_sha1_input(&sha1_context, buf, SHA1_HASH_SIZE); mysql_sha1_result(&sha1_context, hash_stage2_reassured); - return memcmp(hash_stage2, hash_stage2_reassured, SHA1_HASH_SIZE); + return test(memcmp(hash_stage2, hash_stage2_reassured, SHA1_HASH_SIZE)); } -- cgit v1.2.1