Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61052
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.170 as permitted sender)
Message-ID: <4FEEACDE.5020008@gmail.com>
Date: Sat, 30 Jun 2012 09:38:06 +0200
User-Agent: Thunderbird
MIME-Version: 1.0
To: Nikita Popov <nikita.ppv@gmail.com>
CC: PHP internals <internals@lists.php.net>
References: <CAF+90c_e6Lzd_TZXW-2J_fJjNH=3Up9W744=KH5nbwTE_eUDzw@mail.gmail.com>
In-Reply-To: <CAF+90c_e6Lzd_TZXW-2J_fJjNH=3Up9W744=KH5nbwTE_eUDzw@mail.gmail.com>
Content-Type: multipart/alternative;
 boundary="------------070200090704020605050100"
Subject: Re: [PHP-DEV] Asking for a review of crypt() allocation changes
From: keisial@gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)

--------------070200090704020605050100
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On 29/06/12 14:43, Nikita Popov wrote:
> Hi internals!
>
> Anthony and me have been looking a lot at the crypt() code recently
> and noticed that there are some strange things going on in the buffer
> allocations for the sha algorithms.
>
> We did two commits to fix them up a bit:
>
> http://git.php.net/?p=php-src.git;a=commitdiff;h=7e8276ca68fc622124d51d18e4f7b5cde3536de4
It took me a while to realise the problem being fixed. The bug is not
the memset (as reported in bug 62443),
which is using needed (got fixed in e6cf7d), or php_sha{256,512}_crypt_r
(uses a null-terminated string), but the salt[salt_in_len] = '\0';
after allocating only strlen(salt).
So that you would be accessing the position PHP_MAX_SALT_LEN of the
array but have reserved only a few bytes.
Just*sizeof*(sha512_rounds_prefix
<http://lxr.php.net/xref/PHP_TRUNK/ext/standard/crypt.c#sha512_rounds_prefix>)
+ 9 + 1 seem enough for not making bug62443.phpt segfault.
I have been able to crash it with var_dump( crypt("foo", '$6$'.chr(0).
str_pad('', 500, '*') . '$abc') );
but only if it's the first call.



--------------070200090704020605050100--