Req #67939 [Opn]: hash_equals: Don't leak length difference (PR #792)
| From: | dunglas at gmail dot com | Date: | Sun, 31 Aug 2014 00:32:14 +0000 |
| Subject: | Req #67939 [Opn]: hash_equals: Don't leak length difference (PR #792) | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-187354@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=67939&edit=1
ID: 67939
User updated by: dunglas at gmail dot com
Reported by: dunglas at gmail dot com
-Summary: hash_equals: Don't leak length difference (PR #791)
+Summary: hash_equals: Don't leak length difference (PR #792)
Status: Open
Type: Feature/Change Request
Package: hash related
PHP Version: 5.6.0
Block user comment: N
Private report: N
New Comment:
PR reopened against the 5.6 branch: https://github.com/php/php-src/pull/791
Previous Comments:
------------------------------------------------------------------------
[2014-08-31 00:25:29] dunglas at gmail dot com
Description:
------------
https://github.com/php/php-src/pull/791
hash_equals leaks difference in length of compared strings (this is a documented behavior).
This implementation ported from Symfony don't.
The discussion started in a try to use hash_equals in Symfony: symfony/symfony#11797
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=67939&edit=1