Bug #71918 [NEW]: hash_pbkdf2() strips trailing \0 in $password

From: gelenkig at runbox dot com Operating system: Linux PHP version: 5.5.33 Package: hash related Bug Type: Bug Bug description:hash_pbkdf2() strips trailing \0 in $password Description: ------------ hash_pbkdf2() must return different hashes for different $password's but it returns the same hash no matter how many trailing NUL bytes $password has. Test script: --------------- // all 3 variables contain the same hash. $h1 = hash_pbkdf2('sha256', "password", 'salt', 1000); $h2 = hash_pbkdf2('sha256', "password\0", 'salt', 1000); $h3 = hash_pbkdf2('sha256', "password\0\0", 'salt', 1000); // prints TRUE, TRUE but it must be 3 separate hashes: FALSE, FALSE. var_dump($h1===$h2, $h1===$h3); Expected result: ---------------- hash of password !== hash of password\0 !== hash of password\0\0 !== ... -- Edit bug report at https://bugs.php.net/bug.php?id=71918&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71918&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71918&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71918&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71918&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71918&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71918&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71918&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71918&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71918&r=support Expected behavior: https://bugs.php.net/fix.php?id=71918&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71918&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71918&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71918&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71918&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71918&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71918&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71918&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71918&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71918&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71918&r=mysqlcfg