Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 5916a46

Browse filesBrowse files
recrsnrecrsn
authored
Merge pull request #807 from techhead/known_length
2 parents cf4efd9 + f28e916 commit 5916a46
Copy full SHA for 5916a46

File tree

Expand file treeCollapse file tree

4 files changed

+13
-12
lines changed
Filter options
Expand file treeCollapse file tree

4 files changed

+13
-12
lines changed

‎src/bcrypt.cc

Copy file name to clipboardExpand all lines: src/bcrypt.cc
+3-7Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -146,12 +146,11 @@ bcrypt_gensalt(char minor, u_int8_t log_rounds, u_int8_t *seed, char *gsalt)
146146
i.e. $2$04$iwouldntknowwhattosayetKdJ6iFtacBqJdKe6aW7ou */
147147

148148
void
149-
bcrypt(const char *key, const char *salt, char *encrypted)
149+
bcrypt(const char *key, size_t key_len, const char *salt, char *encrypted)
150150
{
151151
blf_ctx state;
152152
u_int32_t rounds, i, k;
153153
u_int16_t j;
154-
size_t key_len;
155154
u_int8_t salt_len, logr, minor;
156155
u_int8_t ciphertext[4 * BCRYPT_BLOCKS+1] = "OrpheanBeholderScryDoubt";
157156
u_int8_t csalt[BCRYPT_MAXSALT];
@@ -215,14 +214,11 @@ bcrypt(const char *key, const char *salt, char *encrypted)
215214
decode_base64(csalt, BCRYPT_MAXSALT, (u_int8_t *) salt);
216215
salt_len = BCRYPT_MAXSALT;
217216
if (minor <= 'a')
218-
key_len = (u_int8_t)(strlen(key) + (minor >= 'a' ? 1 : 0));
217+
key_len = (u_int8_t)(key_len + (minor >= 'a' ? 1 : 0));
219218
else
220219
{
221-
/* strlen() returns a size_t, but the function calls
222-
* below result in implicit casts to a narrower integer
223-
* type, so cap key_len at the actual maximum supported
220+
/* cap key_len at the actual maximum supported
224221
* length here to avoid integer wraparound */
225-
key_len = strlen(key);
226222
if (key_len > 72)
227223
key_len = 72;
228224
key_len++; /* include the NUL */

‎src/bcrypt_node.cc

Copy file name to clipboardExpand all lines: src/bcrypt_node.cc
+4-4Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ namespace {
148148
SetError("Invalid salt. Salt must be in the form of: $Vers$log2(NumRounds)$saltvalue");
149149
}
150150
char bcrypted[_PASSWORD_LEN];
151-
bcrypt(input.c_str(), salt.c_str(), bcrypted);
151+
bcrypt(input.c_str(), input.length(), salt.c_str(), bcrypted);
152152
output = std::string(bcrypted);
153153
}
154154

@@ -185,7 +185,7 @@ namespace {
185185
throw Napi::Error::New(env, "Invalid salt. Salt must be in the form of: $Vers$log2(NumRounds)$saltvalue");
186186
}
187187
char bcrypted[_PASSWORD_LEN];
188-
bcrypt(data.c_str(), salt.c_str(), bcrypted);
188+
bcrypt(data.c_str(), data.length(), salt.c_str(), bcrypted);
189189
return Napi::String::New(env, bcrypted, strlen(bcrypted));
190190
}
191191

@@ -206,7 +206,7 @@ namespace {
206206
void Execute() {
207207
char bcrypted[_PASSWORD_LEN];
208208
if (ValidateSalt(encrypted.c_str())) {
209-
bcrypt(input.c_str(), encrypted.c_str(), bcrypted);
209+
bcrypt(input.c_str(), input.length(), encrypted.c_str(), bcrypted);
210210
result = CompareStrings(bcrypted, encrypted.c_str());
211211
}
212212
}
@@ -243,7 +243,7 @@ namespace {
243243
std::string hash = info[1].As<Napi::String>();
244244
char bcrypted[_PASSWORD_LEN];
245245
if (ValidateSalt(hash.c_str())) {
246-
bcrypt(pw.c_str(), hash.c_str(), bcrypted);
246+
bcrypt(pw.c_str(), pw.length(), hash.c_str(), bcrypted);
247247
return Napi::Boolean::New(env, CompareStrings(bcrypted, hash.c_str()));
248248
} else {
249249
return Napi::Boolean::New(env, false);

‎src/node_blf.h

Copy file name to clipboardExpand all lines: src/node_blf.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ u_int32_t Blowfish_stream2word(const u_int8_t *, u_int16_t , u_int16_t *);
125125

126126
/* bcrypt functions*/
127127
void bcrypt_gensalt(char, u_int8_t, u_int8_t*, char *);
128-
void bcrypt(const char *, const char *, char *);
128+
void bcrypt(const char *, size_t key_len, const char *, char *);
129129
void encode_salt(char *, u_int8_t *, char, u_int16_t, u_int8_t);
130130
u_int32_t bcrypt_get_rounds(const char *);
131131

‎test/implementation.js

Copy file name to clipboardExpand all lines: test/implementation.js
+5Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ module.exports = {
2626
assert.strictEqual(bcrypt.hashSync("0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.XxrQqgBi/5Sxuq9soXzDtjIZ7w5pMfK");
2727
assert.done();
2828
},
29+
test_embedded_nulls: function(assert) {
30+
assert.strictEqual(bcrypt.hashSync("Passw\0rd123", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.VHy/kzL4sCcX3Ib3wN5rNGiRt.TpfxS");
31+
assert.strictEqual(bcrypt.hashSync("Passw\0 you can literally write anything after the NUL character", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.4vJLJQ6nZ/70INTjjSZWQ0iyUek92tu");
32+
assert.done();
33+
},
2934
test_shorten_salt_to_128_bits: function(assert) {
3035
assert.strictEqual(bcrypt.hashSync("test", "$2a$10$1234567899123456789012"), "$2a$10$123456789912345678901u.OtL1A1eGK5wmvBKUDYKvuVKI7h2XBu");
3136
assert.strictEqual(bcrypt.hashSync("U*U*", "$2a$05$CCCCCCCCCCCCCCCCCCCCCh"), "$2a$05$CCCCCCCCCCCCCCCCCCCCCeUQ7VjYZ2hd4bLYZdhuPpZMUpEUJDw1S");

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.