4 ms·
Why would you imagine that? The bug is that what password you provide doesn't matter.
by dangrossman 14y ago
Why would you imagine that? The bug is that what password you provide doesn't matter.
- Negitivefrags 14y agoThat wasn't how I read it. It sounds like they were casting the result of a memcmp to a char. A char only has a range of -128 to 127. The resulting overflow means that an arbitrary password hash has a 1/255 chance of landing on 0, but you still have to try a bunch to hit one.
- mike-cardwell 14y agoThis is incorrect. You do not need to try a different password each time.
- tedunangst 14y agoThe password is combined with a random value on each attempt, the hash will change each time.
- seppo0010 14y agomemcmp will probably return always the same value for the same parameters, which may not trigger the error. Trying different values may yield a value whose mod is 0.