commit ea2a598411cc7bd20456849e56bbc9e93c9916e7
author Joakim Tjernlund <Joakim.Tjernlund@transmode.se> Thu Nov 26 12:23:07 2009 +0000
committer Vincent JARDIN <vincent.jardin@6wind.com> Mon Oct 27 15:57:59 2014 +0100
tree e1825968b9d0f7208b93944980331179456b7625
parent 969d3550a8cbb07f8b4d5ebe8dde5064f8260140

ospfd: invalid MD5 auth_key?

This looks fishy in ospf_make_md5_digest()
if (list_isempty (OSPF_IF_PARAM (oi, auth_crypt)))
    auth_key = (const u_int8_t *) "";
...
MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE);
auth_key points to a "" string of len 1 which is a lot
smaller that OSPF_AUTH_MD5_SIZE. Is this intentional to
get some random data or just a plain bug?

Anyone using MD5 should have a closer look and decide
what to do.
Acked-by: Feng Lu <lu.feng@6wind.com>

ospfd/ospf_packet.c

diff --git a/ospfd/ospf_packet.c b/ospfd/ospf_packet.c
index efdf826..17260eb 100644
--- a/ospfd/ospf_packet.c
+++ b/ospfd/ospf_packet.c
@@ -383,7 +383,7 @@
 ospf_make_md5_digest (struct ospf_interface *oi, struct ospf_packet *op)
 {
   struct ospf_header *ospfh;
-  unsigned char digest[OSPF_AUTH_MD5_SIZE];
+  unsigned char digest[OSPF_AUTH_MD5_SIZE] = {0};
   MD5_CTX ctx;
   void *ibuf;
   u_int32_t t;
@@ -410,7 +410,7 @@
 
   /* Get MD5 Authentication key from auth_key list. */
   if (list_isempty (OSPF_IF_PARAM (oi, auth_crypt)))
-    auth_key = (const u_int8_t *) "";
+    auth_key = (const u_int8_t *) digest;
   else
     {
       ck = listgetdata (listtail(OSPF_IF_PARAM (oi, auth_crypt)));