Skip to content

Commit 83e3466

Browse files
committed
Fix return types of password API helper functions.
This fixes issues that were found during static analysis by cjones where failure was impossible to detect due to return type mangling (casting an int to a char, then comparing to an int).
1 parent 4283f75 commit 83e3466

File tree

2 files changed

+10
-6
lines changed

2 files changed

+10
-6
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ PHP NEWS
2121
. Fixed bug #51127/#65359 Request #25630/#43980/#54383 (Added php_serialize
2222
session serialize handler that uses plain serialize()). (Yasuo)
2323

24+
- Standard:
25+
. Fix issue with return types of password API helper functions. Found via static
26+
analysis by cjones. (Anthony Ferrara)
27+
2428
22 Aug 2013, PHP 5.5.3
2529

2630
- Openssl:

ext/standard/password.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -66,20 +66,20 @@ static php_password_algo php_password_determine_algo(const char *hash, const siz
6666
return PHP_PASSWORD_UNKNOWN;
6767
}
6868

69-
static zend_bool php_password_salt_is_alphabet(const char *str, const size_t len) /* {{{ */
69+
static int php_password_salt_is_alphabet(const char *str, const size_t len) /* {{{ */
7070
{
7171
size_t i = 0;
7272

7373
for (i = 0; i < len; i++) {
7474
if (!((str[i] >= 'A' && str[i] <= 'Z') || (str[i] >= 'a' && str[i] <= 'z') || (str[i] >= '0' && str[i] <= '9') || str[i] == '.' || str[i] == '/')) {
75-
return 0;
75+
return FAILURE;
7676
}
7777
}
78-
return 1;
78+
return SUCCESS;
7979
}
8080
/* }}} */
8181

82-
static zend_bool php_password_salt_to64(const char *str, const size_t str_len, const size_t out_len, char *ret) /* {{{ */
82+
static int php_password_salt_to64(const char *str, const size_t str_len, const size_t out_len, char *ret) /* {{{ */
8383
{
8484
size_t pos = 0;
8585
size_t ret_len = 0;
@@ -108,7 +108,7 @@ static zend_bool php_password_salt_to64(const char *str, const size_t str_len, c
108108
}
109109
/* }}} */
110110

111-
static zend_bool php_password_make_salt(size_t length, char *ret TSRMLS_DC) /* {{{ */
111+
static int php_password_make_salt(size_t length, char *ret TSRMLS_DC) /* {{{ */
112112
{
113113
int buffer_valid = 0;
114114
size_t i, raw_length;
@@ -395,7 +395,7 @@ PHP_FUNCTION(password_hash)
395395
efree(buffer);
396396
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Provided salt is too short: %lu expecting %lu", (unsigned long) buffer_len, (unsigned long) required_salt_len);
397397
RETURN_NULL();
398-
} else if (0 == php_password_salt_is_alphabet(buffer, buffer_len)) {
398+
} else if (php_password_salt_is_alphabet(buffer, buffer_len) == FAILURE) {
399399
salt = safe_emalloc(required_salt_len, 1, 1);
400400
if (php_password_salt_to64(buffer, buffer_len, required_salt_len, salt) == FAILURE) {
401401
efree(hash_format);

0 commit comments

Comments
 (0)