Edit report at http://bugs.php.net/bug.php?id=51254&edit=1
ID: 51254 User updated by: ondrej at sury dot org Reported by: ondrej at sury dot org Summary: Use internal crypt() only for algorithms needed Status: Open Type: Feature/Change Request Package: *Encryption and hash functions Operating System: Linux PHP Version: 5.3.2 New Comment: Hi Pierre, had a time to review this patch and provide a detailed explanation? Ondrej Previous Comments: ------------------------------------------------------------------------ [2010-03-12 11:24:42] paj...@php.net Not sure I agree with these changes, they are not supposed to be valid. I don't have the time now to reply with a detailed explanation but we will do it asap. ------------------------------------------------------------------------ [2010-03-12 10:15:46] ondrej at sury dot org Hi, if you apply my patch, you'll need to apply the fix_crypt_unit_tests.patch, since I have fixed some routines, which you checked in those unit tests. 1. if you use '_' as a first character of the salt, but the salt is not 9 characters long => STD_DES is used. 2. if you use 00-03 or 32-39 as count in blowfish => STD_DES is used (as documented). ------------------------------------------------------------------------ [2010-03-10 08:09:46] ondrej at sury dot org Description: ------------ Attached patch changes crypt.c and accompanying m4 code so it selects only algorithms not supported by system library crypt() for candidates to use internal implementation of crypt(). It also unifies the code to one style (BF and MD5 used static output buffer, sha256,512 allocated the buffer dynamically, etc.), so it's easier to read and understand, which is needed due all #if statements there. Next it fixes some glitches in m4 code. Expected result: ---------------- Use internal implementation only for missing or buggy support for algorithm in system library crypt() function. Actual result: -------------- Internal implementation of crypt() is always selected and used(), when BF or EXT_DES is missing. (Note that due misplaced check for HAVE_CRYPT_R, it will be used even if BF and EXT_DES is present in the system.) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=51254&edit=1
