Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:54803
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain sury.org designates 74.125.82.54 as permitted sender)
MIME-Version: 1.0
Date: Mon, 22 Aug 2011 21:51:08 +0200
Message-ID: <CALjhHG-WyQFarFK7pWW=nMfpwMA2yn3=_C_B2NMZzDRRBMOHdQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Use system crypt() when possible
From: ondrej@sury.org (=?UTF-8?B?T25kxZllaiBTdXLDvQ==?=)

Hi,

I wrote this patch sometime ago and Debian package uses it:

https://bugs.php.net/bug.php?id=3D51254

which in turn made Debian packages not-vulnerable to #55439. (But I
have failed too, I should really start to check to output of the tests
when building the package and compare them for any regressions.)

So I will (ab)use this time and ask for a feedback (again). I only
received this from Pierre:

> Not sure I agree with these changes, they are not supposed to be valid. I=
 don't have the time now to reply with a detailed explanation but we will d=
o it asap.

and the detailed explanation never came.

What the patch does:
- it changes the m4 script to check for each individual cipher and if
found it will use the system library for found ciphers, it will use
PHP implementation for the rest (not-found)

O.
--=20
=EF=BB=BFOnd=C5=99ej Sur=C3=BD <ondrej@sury.org>