Doc #68328 [NEW]: hash_equals does not mention that a difference in str length will leak

From: asphp at dsgml dot com Operating system: PHP version: Irrelevant Package: Documentation problem Bug Type: Documentation Problem Bug description:hash_equals does not mention that a difference in str length will leak Description: ------------ --- From manual page: http://www.php.net/function.hash-equals --- You should document that hash_equals will immediately return false if the strings differ in length. It doesn't even try to compare the strings up to whichever is shorter. It just returns false right away. In some applications this is a problem, so it should be documented. Note: See also Bug #67939 -- Edit bug report at https://bugs.php.net/bug.php?id=68328&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68328&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68328&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68328&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68328&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68328&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68328&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68328&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68328&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68328&r=support Expected behavior: https://bugs.php.net/fix.php?id=68328&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68328&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68328&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68328&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68328&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68328&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68328&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68328&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68328&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68328&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68328&r=mysqlcfg