- Corrected the sanity check of the "setting" string in _crypt_blowfish_rn() to

  reject iteration counts encoded as 36 through 39.  Previously, these would be
  misinterpreted as being the same as 04 through 07. (Solar Designer)

diff --git a/ext/standard/crypt_blowfish.c b/ext/standard/crypt_blowfish.c
index b640a1081b6d84f5e4639b6c9021e781c3620e80..6f728ed7952f51051c28c66487f6125947469746 100644 (file)
--- a/ext/standard/crypt_blowfish.c
+++ b/ext/standard/crypt_blowfish.c
@@ -606,6 +606,7 @@ char *php_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
            setting[3] != '$' ||
            setting[4] < '0' || setting[4] > '3' ||
            setting[5] < '0' || setting[5] > '9' ||
+           (setting[4] == '3' && setting[5] > '1') ||
            setting[6] != '$') {
                __set_errno(EINVAL);
                return NULL;

diff --git a/ext/standard/tests/strings/crypt_blowfish_invalid_rounds.phpt b/ext/standard/tests/strings/crypt_blowfish_invalid_rounds.phpt
index 03c6c8392a1a0b028f00700fbeba960bf6e732ac..6d40b0770e149d9a60c05bf363a96adc5f82d472 100644 (file)
--- a/ext/standard/tests/strings/crypt_blowfish_invalid_rounds.phpt
+++ b/ext/standard/tests/strings/crypt_blowfish_invalid_rounds.phpt
@@ -1,7 +1,5 @@
 --TEST--
 Test Blowfish crypt() with invalid rounds
---XFAIL--
-Needs a patch from Pierre
 --FILE--
 <?php