Home page logo

oss-sec logo oss-sec mailing list archives

Re: glibc crypt(3), crypt_r(3), PHP crypt() may use alloca()
From: Jeff Law <law () redhat com>
Date: Fri, 30 Mar 2012 12:47:54 -0600

On 03/30/2012 12:43 PM, Solar Designer wrote:
On Fri, Mar 30, 2012 at 12:27:31PM -0600, Jeff Law wrote:
I think the right way to handle the return value is to return NULL for
these cases.  It's posix complaint and the glibc crypt routines already
return NULL for exceptional conditions.

Do you realize that plenty of services that use crypt() - likely the
majority of them, even - don't handle NULL returns, so they will
segfault when these conditions are triggered?
Then, IMHO, the app is clearly broken. Crypt has been defined as potentially returning NULL and at least for glibc has done so since the introduction of sha256/sha512, if the app fails to check for that, then the app needs to be fixed.

I don't speak for glibc on this issue, so if you want to raise it on libc-alpha, go for it.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]