Re: Possible to store invalid SCRAM-SHA-256 Passwords

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Michael Paquier <michael(at)paquier(dot)xyz>
Cc: "Jonathan S(dot) Katz" <jkatz(at)postgresql(dot)org>, pgsql-bugs(at)lists(dot)postgresql(dot)org, Stephen Frost <sfrost(at)snowman(dot)net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: 2019-04-23 01:10:49
Message-ID: 10698.1555981849@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

Michael Paquier <michael(at)paquier(dot)xyz> writes:
> There is no point for the second strlen() check, as strspn does the
> same work.

Um, no --- the strspn call will count the number of bytes of hex
data, but without also checking strlen, you don't know that there's
not non-hex trailing junk.

regards, tom lane

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Jonathan S. Katz 2019-04-23 01:16:49 Re: Possible to store invalid SCRAM-SHA-256 Passwords
Previous Message Michael Paquier 2019-04-23 01:01:42 Re: Possible to store invalid SCRAM-SHA-256 Passwords