From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael@paquier.xyz>
cc: "Jonathan S. Katz" <jkatz@postgresql.org>,
 pgsql-bugs@lists.postgresql.org,
        Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
In-reply-to: <20190423010142.GE2712@paquier.xyz>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
 <4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
 <20190422015051.GA3433@paquier.xyz> <3033.1555940554@sss.pgh.pa.us>
 <5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org>
 <30284.1555972921@sss.pgh.pa.us>
 <15140775-08c3-45bd-6dab-fdcd290d1bf0@postgresql.org>
 <20190423010142.GE2712@paquier.xyz>
Comments: In-reply-to Michael Paquier <michael@paquier.xyz>
	message dated "Tue, 23 Apr 2019 10:01:42 +0900"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <10697.1555981849.1@sss.pgh.pa.us>
Date: Mon, 22 Apr 2019 21:10:49 -0400
Message-ID: <10698.1555981849@sss.pgh.pa.us>
Precedence: bulk

Michael Paquier <michael@paquier.xyz> writes:
> There is no point for the second strlen() check, as strspn does the
> same work.

Um, no --- the strspn call will count the number of bytes of hex
data, but without also checking strlen, you don't know that there's
not non-hex trailing junk.

			regards, tom lane