4 ms·
There was a fun MySQL bug[1] a while back involving similar functions and SSE(I think) instructions where the MySQL check was something like: if((my_bool)me
by vvanders 9y ago
There was a fun MySQL bug[1] a while back involving similar functions and SSE(I think) instructions where the MySQL check was something like:
if((my_bool)memcmp(password, hash) == 0)
Except that the SSE function would return nonzero of > 256 which would truncate to 0. Since the hash was seeded with time you could just spin-lock your way to entry on any system of that arch.
So while they may have been "correct" there's always fun implications when you deploy them in the wild.
[1] - https://nvd.nist.gov/vuln/detail/CVE-2012-2122 https://nvd.nist.gov/vuln/detail/CVE-2012-2122