lib/chkhash.c: is_valid_hash(): Accept an empty hash

alejandro-colomar · alejandro-colomar · commit bdf93b20a952 · 2026-01-15T01:23:02.000+01:00
It represents a passwordless account. That is discouraged, but accepted. Link: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1124835> Reported-by: Marc 'Zugschlus' Haber <mh+githubvisible@zugschlus.de> Reported-by: "Serge E. Hallyn" <serge@hallyn.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
diff --git a/lib/chkhash.c b/lib/chkhash.c
@@ -42,6 +42,10 @@ is_valid_hash(const char *hash)
 {
 	hash = strprefix(hash, "!") ?: hash;
 
+	// Passwordless account; discouraged
+	if (streq(hash, ""))
+		return true;
+
 	if (streq(hash, "*"))
 		return true;
 

Original file line number	Diff line number	Diff line change
`@@ -42,6 +42,10 @@ is_valid_hash(const char *hash)`
`42`	`42`	`{`
`43`	`43`	`hash = strprefix(hash, "!") ?: hash;`
`44`	`44`
	`45`	`+ // Passwordless account; discouraged`
	`46`	`+ if (streq(hash, ""))`
	`47`	`+ return true;`
	`48`	`+`
`45`	`49`	`if (streq(hash, "*"))`
`46`	`50`	`return true;`
`47`	`51`