[php-src] Issue #8397: crypt() accepts invalid characters in salt
| From: | martenlehmann | Date: | Thu, 21 Apr 2022 12:08:45 +0000 |
| Subject: | [php-src] Issue #8397: crypt() accepts invalid characters in salt | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-241118@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8397
Comment Author: martenlehmann
From a user perspective, if I install Ubuntu's
[php7.4](https://packages.ubuntu.com/focal/php7.4) package, there's no way to tell which
version of
crypt() is being used or has been linked against at built-time.
Since Perl's and Python's crypt() functions independently yet both return
*0 on invalid salts and PHP's crypt() in Ubuntu 20.04 doesn't,
I'd assume it does not use the system crypt. Besides, the *0 return to mark an
error doesn't seem well documented anywhere and has been pretty unexpected to me.