Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <avXUkpcnCLdIREEN@devuan>
Date: Thu, 12 Nov 2026 16:01:30 +0100
From: Alejandro Colomar <alx+linux-man@...nel.org>
To: Rich Felker <dalias@...c.org>
Cc: Walter Harms <wharms@....de>, 
	"linux-man@...r.kernel.org" <linux-man@...r.kernel.org>, libc-alpha@...rceware.org, musl@...ts.openwall.com, 
	~hallyn/shadow@...ts.sr.ht
Subject: Re: Re: RFC: how to document musl-crypt failure ?

Hi Rich,

> Date: 2026-11-12 09:45:53-0500
> From: Rich Felker <dalias@...c.org>
>
[...]
> > 	--- HEAD:man/man3/crypt.3
> > 	+++ ./man/man3/crypt.3
> > 	@@ -152,6 +152,19 @@ NOTES
> > 	      than 1000, 999999999 if xxx is greater than 999999999, and
> > 	      is equal to xxx otherwise.
> > 	 
> > 	+EXAMPLES
> > 	+     When comparing a password against an existing hash, that
> > 	+     hash (and no other) must be passed as salt.  If and only
> > 	+     if salt compares equal (see streq(3)) to the returned
> > 	+     string, the password matches the existing hash specified
> > 	+     by salt.
> > 	+
> > 	+         if (streq(H, crypt(P, H))) {
> > 	+              // good password
> > 	+         } else {
> > 	+              // bad password
> > 	+         }
> > 	+
> > 	 SEE ALSO
> > 	      login(1), passwd(1), encrypt(3), getpass(3), passwd(5)
> 
> Missing null return check.

Ouch!  Thanks!

	--- HEAD:man/man3/crypt.3
	+++ ./man/man3/crypt.3
	@@ -152,6 +152,20 @@ NOTES
	      than 1000, 999999999 if xxx is greater than 999999999, and
	      is equal to xxx otherwise.
	 
	+EXAMPLES
	+     When comparing a password against an existing hash, that
	+     hash (and no other) must be passed as salt.  If and only
	+     if salt compares equal (see streq(3)) to the returned
	+     string, the password matches the existing hash specified
	+     by salt.
	+
	+         const char  *h = crypt(P, H);
	+         if (h != NULL && streq(h, H)) {
	+              // good password
	+         } else {
	+              // bad password
	+         }
	+
	 SEE ALSO
	      login(1), passwd(1), encrypt(3), getpass(3), passwd(5)
 
Cheers,
Alex

-- 
<https://www.alejandro-colomar.es>

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.