Re: [HACKERS] crypt and null termination

2001-08-17 Thread Peter Eisentraut
Bruce Momjian writes: > > Bruce Momjian writes: > > > > > Anyway, the patch is small so I will apply it. There is no telling what > > > OS's expect a character string there. > > > > There's a pretty good telling: Nobody ever reported a problem related to > > this. > > We have had crypts that di

Re: [HACKERS] crypt and null termination

2001-08-17 Thread Bruce Momjian
> Bruce Momjian writes: > > > Anyway, the patch is small so I will apply it. There is no telling what > > OS's expect a character string there. > > There's a pretty good telling: Nobody ever reported a problem related to > this. We have had crypts that didn't work across platforms. -- Bru

Re: [HACKERS] crypt and null termination

2001-08-17 Thread Peter Eisentraut
Bruce Momjian writes: > Anyway, the patch is small so I will apply it. There is no telling what > OS's expect a character string there. There's a pretty good telling: Nobody ever reported a problem related to this. -- Peter Eisentraut [EMAIL PROTECTED] http://funkturm.homeip.net/~peter

Re: [HACKERS] crypt and null termination

2001-08-16 Thread Bruce Momjian
> > and conn.salt is char[2]. Isn't this a problem? > > I don't think it is. Note that it refers to the salt as a "character > array", not a string. Also, since '_' isn't in the allowed encoding > set, it can tell the difference between a 9-byte salt and a 2-byte > salt without a terminating N

Re: [HACKERS] crypt and null termination

2001-08-16 Thread Doug McNaught
Bruce Momjian <[EMAIL PROTECTED]> writes: > > > and conn.salt is char[2]. Isn't this a problem? > > > > I don't think it is. Note that it refers to the salt as a "character > > array", not a string. Also, since '_' isn't in the allowed encoding > > set, it can tell the difference between a 9-

Re: [HACKERS] crypt and null termination

2001-08-16 Thread Bruce Momjian
> Bruce Momjian <[EMAIL PROTECTED]> writes: > > It seems to say that the salt passed to crypt should be null-terminated, > > Hmm. The HPUX man page for crypt() just says that > salt is a two-character string chosen from the set [a-zA-Z0-9./] > which I think is the traditional spec. Looks

Re: [HACKERS] crypt and null termination

2001-08-16 Thread Doug McNaught
Bruce Momjian <[EMAIL PROTECTED]> writes: > Look at this from the BSD/OS crypt() manual page: > > The crypt function performs password encryption. It is derived from the > NBS Data Encryption Standard. Additional code has been added to deter > key search attempts. The first arg

Re: [HACKERS] crypt and null termination

2001-08-16 Thread Tom Lane
Bruce Momjian <[EMAIL PROTECTED]> writes: > It seems to say that the salt passed to crypt should be null-terminated, Hmm. The HPUX man page for crypt() just says that salt is a two-character string chosen from the set [a-zA-Z0-9./] which I think is the traditional spec. Looks like BSD h

[HACKERS] crypt and null termination

2001-08-16 Thread Bruce Momjian
Look at this from the BSD/OS crypt() manual page: The crypt function performs password encryption. It is derived from the NBS Data Encryption Standard. Additional code has been added to deter key search attempts. The first argument to crypt is a NUL-terminated string (norma