Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4F75FFDA.3010002@redhat.com>
Date: Fri, 30 Mar 2012 12:47:54 -0600
From: Jeff Law <law@...hat.com>
To: Solar Designer <solar@...nwall.com>
CC: oss-security@...ts.openwall.com
Subject: Re: glibc crypt(3), crypt_r(3), PHP crypt() may use
 alloca()

On 03/30/2012 12:43 PM, Solar Designer wrote:
> On Fri, Mar 30, 2012 at 12:27:31PM -0600, Jeff Law wrote:
>> I think the right way to handle the return value is to return NULL for
>> these cases.  It's posix complaint and the glibc crypt routines already
>> return NULL for exceptional conditions.
>
> Do you realize that plenty of services that use crypt() - likely the
> majority of them, even - don't handle NULL returns, so they will
> segfault when these conditions are triggered?
Then, IMHO,  the app is clearly broken.  Crypt has been defined as 
potentially returning NULL and at least for glibc has done so since the 
introduction of sha256/sha512, if the app fails to check for that, then 
the app needs to be fixed.

I don't speak for glibc on this issue, so if you want to raise it on 
libc-alpha, go for it.

Jeff

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.