Req #67939 [NEW]: hash_equals: Don't leak length difference (PR #791)
| From: | dunglas at gmail dot com | Date: | Sun, 31 Aug 2014 00:25:29 +0000 |
| Subject: | Req #67939 [NEW]: hash_equals: Don't leak length difference (PR #791) | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-187353@lists.php.net to get a copy of this message | ||
From: dunglas at gmail dot com
Operating system:
PHP version: 5.6.0
Package: hash related
Bug Type: Feature/Change Request
Bug description:hash_equals: Don't leak length difference (PR #791)
Description:
------------
https://github.com/php/php-src/pull/791
hash_equals leaks difference in length of compared strings (this is a
documented behavior).
This implementation ported from Symfony don't.
The discussion started in a try to use hash_equals in Symfony:
symfony/symfony#11797
--
Edit bug report at https://bugs.php.net/bug.php?id=67939&edit=1
--