Date: Sun, 19 Aug 2012 22:12:23 -0400 From: Rich Felker <dalias@...ifal.cx> To: musl@...ts.openwall.com Subject: Re: Help-wanted tasks for musl On Mon, Aug 20, 2012 at 03:58:54AM +0200, Szabolcs Nagy wrote: > > I agree it would be nicer to just pass the salt through the encryption > > algorithm as part of the input, but in practice they all decode it as > > a base64 number and use that number... > > > > sha and md5 crypt does not decode the salt > it is directly passed to a hash function Ah, that makes it uglier then, because presumably some of these malformed things you mentioned are "valid" salt. By the way, if "strtoul" is used in the definition of what makes a valid unsigned long, then a '-' sign is valid, and the result is implementation-specific since it involves reduction modulo ULONG_MAX+1. For low values like -100, it won't matter, since the high values get clipped to 1000, but for example -4294967295 would become 1 on 32-bit systems and get clipped to 1000 on 64-bit systems... BTW², this is a very good general reason why "strtou*" are broken interfaces that should never be used directly in software that wants consistent cross-platform behavior. To use them safely you need to skip leading whitespace manually (if you want to support it at all), then check that the first non-whitespace character is not a '-' before passing the tail to strtou*. Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.