Problem in extracting salt

[viennadd]

need a look,

In function tr_ssha1_matches, in line 165 ,if sourcelen equals 2 * SHA_DIGEST_LENGTH - 1,

then

 if (sourcelen < 2 * SHA_DIGEST_LENGTH - 1)    // this will take false block
    return false;
  saltlen = sourcelen - 2 * SHA_DIGEST_LENGTH - 1;     // sourcelen == 2 * SHA_DIGEST_LENGTH - 1, then saltlen should be assigned 0;
  salt = tr_malloc (saltlen);       // malloc(0), then salt = NULL
  memcpy (salt, ssha1 + 2 * SHA_DIGEST_LENGTH + 1, saltlen);   // <== pass invalid null pointer into memcpy, 

I think most of memcpy implementations would do nothing if len argument is 0, but passing null pointer into is an undefined behaviour, may be you could take a look and see if there are any problems

[mikedld]

Thanks!