From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/1655 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Help-wanted tasks for musl Date: Sun, 19 Aug 2012 22:12:23 -0400 Message-ID: <20120820021223.GE27715@brightrain.aerifal.cx> References: <20120819042611.GA8731@brightrain.aerifal.cx> <20120819114914.GD16602@port70.net> <20120819165652.GE16602@port70.net> <20120819172921.GF16602@port70.net> <20120820005128.GB27715@brightrain.aerifal.cx> <20120820013502.GG16602@port70.net> <20120820013950.GC27715@brightrain.aerifal.cx> <20120820015854.GH16602@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Trace: ger.gmane.org 1345428668 30293 80.91.229.3 (20 Aug 2012 02:11:08 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 20 Aug 2012 02:11:08 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-1656-gllmg-musl=m.gmane.org@lists.openwall.com Mon Aug 20 04:11:09 2012 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1T3HSK-00010K-NA for gllmg-musl@plane.gmane.org; Mon, 20 Aug 2012 04:11:04 +0200 Original-Received: (qmail 3651 invoked by uid 550); 20 Aug 2012 02:11:03 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 3643 invoked from network); 20 Aug 2012 02:11:03 -0000 Content-Disposition: inline In-Reply-To: <20120820015854.GH16602@port70.net> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:1655 Archived-At: On Mon, Aug 20, 2012 at 03:58:54AM +0200, Szabolcs Nagy wrote: > > I agree it would be nicer to just pass the salt through the encryption > > algorithm as part of the input, but in practice they all decode it as > > a base64 number and use that number... > > > > sha and md5 crypt does not decode the salt > it is directly passed to a hash function Ah, that makes it uglier then, because presumably some of these malformed things you mentioned are "valid" salt. By the way, if "strtoul" is used in the definition of what makes a valid unsigned long, then a '-' sign is valid, and the result is implementation-specific since it involves reduction modulo ULONG_MAX+1. For low values like -100, it won't matter, since the high values get clipped to 1000, but for example -4294967295 would become 1 on 32-bit systems and get clipped to 1000 on 64-bit systems... BTW², this is a very good general reason why "strtou*" are broken interfaces that should never be used directly in software that wants consistent cross-platform behavior. To use them safely you need to skip leading whitespace manually (if you want to support it at all), then check that the first non-whitespace character is not a '-' before passing the tail to strtou*. Rich