pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Jonathan S. Katz <jkatz@postgresql.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-bugs@lists.postgresql.org, Stephen Frost <sfrost@snowman.net>
Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
Date: Mon, 22 Apr 2019 21:16:49 -0400
Message-ID: <265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org> (raw)
In-Reply-To: <10698.1555981849@sss.pgh.pa.us>
References: <016deb6b-1f0a-8e9f-1833-a8675b170aa9@postgresql.org>
	<4240a41f-a957-fd7d-7c24-31683f259b9d@postgresql.org>
	<20190422015051.GA3433@paquier.xyz>
	<3033.1555940554@sss.pgh.pa.us>
	<5a93333c-dde6-ee52-f870-4dccfc50eb6f@postgresql.org>
	<30284.1555972921@sss.pgh.pa.us>
	<15140775-08c3-45bd-6dab-fdcd290d1bf0@postgresql.org>
	<20190423010142.GE2712@paquier.xyz>
	<10698.1555981849@sss.pgh.pa.us>

On 4/22/19 9:10 PM, Tom Lane wrote:
> Michael Paquier <michael@paquier.xyz> writes:
>> There is no point for the second strlen() check, as strspn does the
>> same work.
> 
> Um, no --- the strspn call will count the number of bytes of hex
> data, but without also checking strlen, you don't know that there's
> not non-hex trailing junk.

+1; that's why I left the comparison in.

(e.g. "md512345678901234567890123456789012zzz" would pass without strlen).

Jonathan

Attachments:

  [application/pgp-signature] signature.asc (832B, ../265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org/2-signature.asc)
  download

view thread (27+ messages)  latest in thread

Message-ID: <265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org>
Permalink:  ../265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org/
Also on:    postgresql.org/message-id/265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: jkatz@postgresql.org, tgl@sss.pgh.pa.us, michael@paquier.xyz, sfrost@snowman.net
  Subject: Re: Possible to store invalid SCRAM-SHA-256 Passwords
  In-Reply-To: <265876b8-1a72-89cd-bdcf-e641d93e166c@postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox