[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <avW906X136SKnaX_@devuan>
Date: Thu, 12 Nov 2026 14:26:15 +0100
From: Alejandro Colomar <alx+linux-man@...nel.org>
To: Vincent Lefevre <vincent@...c17.net>,
Alejandro Colomar <alx@...nel.org>, Rich Felker <dalias@...c.org>, linux-man@...r.kernel.org,
libc-alpha@...rceware.org, Walter Harms <wharms@....de>, ~hallyn/shadow@...ts.sr.ht,
musl@...ts.openwall.com
Subject: Re: Re: [PATCH v1] man/man3/crypt.3: These functions accept
many algorithms, not only DES
Hi Vincent,
> Date: 2026-11-12 14:15:47+0100
> From: Vincent Lefevre <vincent@...c17.net>
>
> On 2026-11-12 13:08:12 +0100, Alejandro Colomar wrote:
> > > This means that when "$" is supported by some implementation,
> > > the interpretation of the return value may be different from
> > > what POSIX specifies.
> >
> > Kind of. They better don't deviate from it in non-confirming ways;
> > one could argue that musl's "x" return value is indeed such a
> > non-conforming return value, and a NULL return value would be better
> > (both more conforming and safer).
>
> This is more complex. The issue is that in the past, crypt() seemed to
> have been designed so that it could not fail (except in the case where
> it wasn't providing any implementation, i.e. it was always failing),
> so that applications did not expect a null pointer and some of them
> still do not check this case. Hence the choice done my musl.
It would be interesting to list all FOSS programs that forget to check
for NULL, and perhaps talk to them to update their code.
Cheers,
Alex
> Problems could be avoided only by writing more robust applications:
> * They should have had a check for the null pointer.
> * When a hash is obtained, applications should also check
> whether the hash has the expected form (for instance,
> the "*" returned by musl does not).
>
> --
> Vincent Lefèvre <vincent@...c17.net> - Web: <https://www.vinc17.net/>
> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
--
<https://www.alejandro-colomar.es>
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
