[Bug crypt/26300] New: crypt documentation mentions two characters for salt

[stefan at konink dot de]

https://sourceware.org/bugzilla/show_bug.cgi?id=26300

            Bug ID: 26300
           Summary: crypt documentation mentions two characters for salt
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: crypt
          Assignee: unassigned at sourceware dot org
          Reporter: stefan at konink dot de
  Target Milestone: ---

Created attachment 12724
  --> https://sourceware.org/bugzilla/attachment.cgi?id=12724&action=edit
Small program to demonstrate the issue.

Within the man page of crypt the following sentence appears: "salt is a
two-character string chosen from the set [a-zA-Z0-9./].  This string is used to
perturb the algorithm in one of 4096 different ways."

My primary question is: must this string be zero terminated?

>From a program tested with AddressSanitizer (ASAN) I have extracted a small
practise for its use towards crypt_r. I have compiled the program using gcc -O0
-ggdb3 -fsanitize=address -fsanitize-recover=address -lasan -lcrypt -o test
test.c

A stack-buffer-overflow appears iff the salt has not been zero terminated.
Could this problem be explored and/or the man page be updated?

-- 
You are receiving this mail because:
You are on the CC list for the bug.