NigelCunningham
fix make scrambled password segmentation fault bug when password longer than 26 characters
Comment Hello, I found a segmentation fault bug when use long long password(longer than 26 characters. like 32) in make_scrambled_password function.
During create password by sha1, temporary variable h0 will set zero for clear. But, for now, set zero to h0 until length of password .
h0 variable is just 20 bytes, but password can set 255 characters. So if password is too long, I thing it will cleanup data even outside of the h0 variable range.
In this PR, make set zero h0 just for size of h0 for not occur segmentation fault.
Thanks for your PR. I'm creating a test to cover this issue and will then merge the patch.
Further to this - I'm wondering whether we should actually keep this code; the 323 method was proven insecure a long, long time ago. What use it is nowadays?
What use it is nowadays?
Well, you're right. This algorithm insecure so mysql drop it long time ago. But I think, like our case, a lot of users use this library with 323 method for resolve there authentifications since long time ago 😅
Thanks for the reply. I guess it's time to encourage them to move on to something that's actually secure then. I'll add a new flag to the meson configuration to enable deprecated algorithms and make this (and other insecure ones) deprecated and disabled by default.
Maybe we can trigger a notice into syslog mentioning this algo is insecure, nudging people to migrate to a more modern alternative? Sort as a first step towards deprecation.
