Debian Bug report logs - #572561
php5: crypt() output inconsistency between version 5.2 and 5.3

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Fonso <ulfonk_mennhar@gmx.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php5: crypt() output inconsistency between version 5.2 and 5.3

Date: Thu, 04 Mar 2010 22:30:19 +0100

Package: php5
Version: 5.3.1-5
Severity: important


The output of crypt() for certain salts has changed between version 5.2.6-1+lenny6 and 5.3.1-5
The following small test script demonstrates this:

<?php echo crypt("semmel", "1$"); ?>

With php 5.3.1-5 this results in: 1$YZfgMfg2BiI
With php 5.2.6-1+lenny6 this results in: 1$IjqLeTnxFwo

As far as I can see from the documentation at http://de.php.net/manual/en/function.crypt.php "1$" is a valid salt for standard DES.

As a side note, the same output is generated, with the following script which provides an invalid, but different, salt:

<?php echo crypt("semmel", 1); ?>

-- System Information:
Debian Release: squeeze/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-trunk-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages php5 depends on:
ii  libapache2-mod-php5           5.3.1-5    server-side, HTML-embedded scripti
ii  php5-common                   5.3.1-5    Common files for packages built fr

php5 recommends no packages.

php5 suggests no packages.

-- no debconf information

Message #10 received at 572561@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: Fonso <ulfonk_mennhar@gmx.de>, 572561@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: [php-maint] Bug#572561: php5: crypt() output inconsistency between version 5.2 and 5.3

Date: Thu, 4 Mar 2010 23:45:34 -0600

tag 572561 fixed-upstream
reassign 572561 php5-common 5.3.1-5
clone 572561 -1
retitle -1 PHP's bundled crypt implementation is used
severity -1 normal
thanks

Hi,

On 4 March 2010 15:30, Fonso <ulfonk_mennhar@gmx.de> wrote:
> Package: php5
> Version: 5.3.1-5
> Severity: important
>
>
> The output of crypt() for certain salts has changed between version 5.2.6-1+lenny6 and 5.3.1-5
> The following small test script demonstrates this:
>
> <?php echo crypt("semmel", "1$"); ?>
>
> With php 5.3.1-5 this results in: 1$YZfgMfg2BiI
> With php 5.2.6-1+lenny6 this results in: 1$IjqLeTnxFwo

This has already been fixed by upstream and the fix is included in
5.3.2 which should be uploaded some time soon.

In case you urgently need it to work the way it used to, this commit fixes it:
http://svn.php.net/viewvc?view=revision&revision=295340

> As a side note, the same output is generated, with the following script which provides an invalid, but different, salt:

Not sure this can be treated as a bug (if you insist, report it
upstream) as the salt is obviously invalid. The memory where the salt
is copied to is filled with '$'s which in this case leads to the same
result: '1$'.

As a side note... this bug would not have been triggered if php was
actually using the system's crypt(3) instead of the bundled copy. This
in turn means that something failed during the configure checks.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

Message #25 received at 572561-done@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: 572561-done@bugs.debian.org

Subject: Fixed with use of system crypt

Date: Thu, 21 Oct 2010 11:20:03 +0200

Version: 5.3.2-2

We have updated php5 to use system crypt. php5 5.3.2-2 and higher returns:

1$IjqLeTnxFwo

again.

Ondrej
-- 
Ondřej Surý <ondrej@sury.org>

Send a report that this bug log contains spam.