Bug #69686 [Asn->Csd]: password_verify reports back error on PHP7 will null string

Edit report at https://bugs.php.net/bug.php?id=69686&edit=1 ID: 69686 Updated by: ircmaxell@php.net Reported by: ccornutt at phpdeveloper dot org Summary: password_verify reports back error on PHP7 will null string -Status: Assigned +Status: Closed Type: Bug Package: hash related Operating System: Linux PHP Version: master-Git-2015-05-21 (Git) Assigned To: ircmaxell Block user comment: N Private report: N New Comment: Automatic comment on behalf of ircmaxell@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=ed4052f1d5309cc974b134c2b78724d727ef9349 Log: Fixed bug #69686 password_verify reports back error on PHP7 will null string. Previous Comments: ------------------------------------------------------------------------ [2015-05-21 20:48:56] ccornutt at phpdeveloper dot org Description: ------------ A password_verify call with a second parameter value of null an error is reported in PHP 7 where none was thrown in PHP 5.5: Example: "Deprecated: password_verify(): Supplied salt is not valid for DES. Possible bug in provided salt format. in /in/ThW5f on line 6" http://3v4l.org/ThW5f Test script: --------------- <?php // Run in current version of PHP 7 $input = 'test'; $hash = null; $result = password_verify($input, $hash); var_export($result); Expected result: ---------------- false (as it was in PHP 5.5) as the string to verify isn't even valid Actual result: -------------- The way HHVM handles it would be nice: Catchable fatal error: Argument 2 passed to password_verify() must be an instance of string, null given in /in/ThW5f on line 6 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69686&edit=1