Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:54270 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 91207 invoked from network); 31 Jul 2011 23:05:31 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 31 Jul 2011 23:05:31 -0000 Authentication-Results: pb1.pair.com smtp.mail=smalyshev@sugarcrm.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=smalyshev@sugarcrm.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain sugarcrm.com designates 207.97.245.163 as permitted sender) X-PHP-List-Original-Sender: smalyshev@sugarcrm.com X-Host-Fingerprint: 207.97.245.163 smtp163.iad.emailsrvr.com Linux 2.6 Received: from [207.97.245.163] ([207.97.245.163:47763] helo=smtp163.iad.emailsrvr.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id E1/AA-24421-ABFD53E4 for ; Sun, 31 Jul 2011 19:05:31 -0400 Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp46.relay.iad1a.emailsrvr.com (SMTP Server) with ESMTP id 27417E81FC; Sun, 31 Jul 2011 19:05:28 -0400 (EDT) X-Virus-Scanned: OK Received: by smtp46.relay.iad1a.emailsrvr.com (Authenticated sender: smalyshev-AT-sugarcrm.com) with ESMTPSA id BEFA2E81EB; Sun, 31 Jul 2011 19:05:27 -0400 (EDT) Message-ID: <4E35DFB6.10903@sugarcrm.com> Date: Sun, 31 Jul 2011 16:05:26 -0700 Organization: SugarCRM User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110624 Thunderbird/5.0 MIME-Version: 1.0 To: Solar Designer CC: PHP Internals List References: <20110719234406.GB28946@openwall.com> <4E35CC70.1050203@sugarcrm.com> <20110731223327.GA23361@openwall.com> In-Reply-To: <20110731223327.GA23361@openwall.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] CRYPT_SHA256 fails tests in trunk From: smalyshev@sugarcrm.com (Stas Malyshev) Hi! On 7/31/11 3:33 PM, Solar Designer wrote: > Now that I look at this, I think there are more problems around this > place in the code: I just fixed the immediate problem, but giving a second look to this code I don't really understand why there should be NULL termination at all - we know the length anyway, and can use it directly. And underlying functions seem never to rely on null-termination. > 2. alloca() of potentially user-controlled size is unsafe - it may > result in the stack pointer being moved outside of allowable range and This is true. This code doesn't seem to have any limits on key length. We probably should add a check somewhere in crypt.c. I'll look into it soon. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227