| From: | Prashant Kumar <crprashant(at)hotmail(dot)com> |
|---|---|
| To: | "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
| Subject: | [PATCH] pgcrypto: Fix sha-crypt rounds= values that do not fit in int (BUG #19743) |
| Date: | 2026-10-23 14:30:17 |
| Message-ID: | SN7P223MB0600215618AD31B5ACE2109EDD642@SN7P223MB0600.NAMP223.PROD.OUTLOOK.COM |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Hi hackers,
Attached is a patch for BUG #19743, reported by Ke Han [1]:
pgcrypto's crypt() parses the rounds= option of a sha256crypt /
sha512crypt salt with strtoint() and never checks errno, so a
value that does not fit in an int is silently reduced modulo
2^32 before the supported-range clamping runs. For example,
rounds=4294968296 produces a hash computed with the minimum of
1000 rounds and no NOTICE at all, and rounds=4294967295 is
reported as "rounds=-1".
I reproduced this on current master (20devel) before fixing it.
The patch checks errno around the strtoint() call in
px_crypt_shacrypt(). On ERANGE the value is out of range in
the direction of its sign, so it is clamped to
PX_SHACRYPT_ROUNDS_MIN or PX_SHACRYPT_ROUNDS_MAX, matching the
existing clamp-with-NOTICE behaviour for in-range values, and
the NOTICEs now report the value as supplied instead of the
truncated conversion result.
Regression tests are added to crypt-shacrypt: negative overflow
cases for both $5$ and $6$, checked against full hashes, and
positive overflow cases run under a short statement_timeout so
the tests never actually compute ~1e9 rounds. The pgcrypto
regression suite (25 tests) and the core regression suite
(239 tests) both pass with the patch applied.
This is my first patch submission; feedback is welcome.
Testing was done with AI assistance.
[1] https://postgr.es/m/19743-c48782d257b89819@postgresql.org
Thanks,
Prashant Chinnam
| Attachment | Content-Type | Size |
|---|---|---|
| v1-0001-pgcrypto-Fix-sha-crypt-rounds-values-that-do-not-fit.patch | application/octet-stream | 9.6 KB |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Dean Rasheed | 2026-10-23 14:41:38 | Re: [DEPARSE] EXPLAIN prints another ModifyTable's RETURNING aliases in a SubPlan |
| Previous Message | Tom Lane | 2026-10-23 14:10:49 | Re: [DEPARSE] EXPLAIN prints another ModifyTable's RETURNING aliases in a SubPlan |