From cb7dc25b30b0926bab7767e186e12007675bcd8c Mon Sep 17 00:00:00 2001
From: Andrew Engelbrecht <andrew@fsf.org>
Date: Fri, 7 Jan 2022 11:56:34 -0500
Subject: [PATCH] check for invalid extra lines of input

only one line of input is valid for the glue code between the ssp lib
and the drupal libs used for authentication
---
 extlib/drupal-pw-check.php | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/extlib/drupal-pw-check.php b/extlib/drupal-pw-check.php
index cd09e70..82825c5 100644
--- a/extlib/drupal-pw-check.php
+++ b/extlib/drupal-pw-check.php
@@ -1,5 +1,7 @@
 <?php
 
+# Copyright 2022 Andrew Engelbrecht GPLv3-or-later
+
 # checks cleartext password against a drupal password hash
 # intput is a json string containing a list which contains both input strings.
 
@@ -7,6 +9,13 @@ require './bootstrap.inc';
 require './password.inc';
 
 $line = fgets(STDIN);
+$line2 = fgets(STDIN);
+
+if ($line2 != "") {
+	fwrite(STDERR, "too many lines of input\n");
+	echo "false";
+	exit(1);
+}
 
 $password_and_hash = json_decode(rtrim($line));
 
-- 
2.25.1