Hi, I gave a quick review to the overal implementation of this feature. A few comments:
- php_password_make_salt() shouldn't allocate memory + do memcpy, but it should fill in 'ret' directly instead. Both mallocs can go away. - in PHP_FUNCTION(password_get_info) you assume that sscanf always succeeds. That's not the case if I pass a mis-encoded string. - in PHP_FUNCTION(password_hash) you don't need to estrndup the salt, since you're just reading it. - Similarly, no needs to emallocs and sprintf. You should write directly to the final string to avoid the copies. - The sprintf() there is probably not ok if the salt includes a \0 in the middle.
In summary, there should be few or no mallocs in this file, since most buffers have a maximum (small) size that can be determined statically.
Nuno
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
