Bug #61852 [Opn->Csd]: crypt() function incorrectly falls back to CRYPT_STD_DES

Edit report at https://bugs.php.net/bug.php?id=61852&edit=1 ID: 61852 Updated by: nikic@php.net Reported by: rchouinard at gmail dot com Summary: crypt() function incorrectly falls back to CRYPT_STD_DES -Status: Open +Status: Closed Type: Bug Package: *Encryption and hash functions Operating System: CentOS 5 PHP Version: 5.3.10 -Assigned To: +Assigned To: nikic Block user comment: N Private report: N New Comment: This has been fixed in PHP 8.0 (though a deprecation warning is already thrown since some earlier version). Previous Comments: ------------------------------------------------------------------------ [2012-04-25 20:27:32] rchouinard at gmail dot com Description: ------------ The crypt() method fails bcrypt test vectors given by Openwall's crypt v1.2. Specifically, when given an invalid identifier, crypt() falls back to CRYPT_STD_DES, even though the first two bytes of the salt do not match the documented "./0-9A-Za-z" range for CRYPT_STD_DES. The expected behavior would be to return *0. I've tested this under PHP 5.3.10 on Zend Server on CentOS 5 and Windows 7. Test script: --------------- <?php // Expect *0, returns $2OahnOya9Dwg echo crypt('', '$2`$05$CCCCCCCCCCCCCCCCCCCCC.') . PHP_EOL; // Expect *0, returns $2OahnOya9Dwg echo crypt('', '$2{$05$CCCCCCCCCCCCCCCCCCCCC.') . PHP_EOL; // Expect *1, returns *0Vh7kctua2ww echo crypt('', '*0') . PHP_EOL; Expected result: ---------------- *0 *0 *1 Actual result: -------------- $2OahnOya9Dwg $2OahnOya9Dwg *0Vh7kctua2ww ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=61852&edit=1