32
32
#include <openssl/kdf.h>
33
33
#include <openssl/thread.h>
34
34
35
- #define MEMLIMIT_MIN 8u
36
- #define MEMLIMIT_MAX 0xFFFFFFFFu
37
- #define OPSLIMIT_MIN 1u
38
- #define OPSLIMIT_MAX 0xFFFFFFFFu
39
- #define THREADS_MIN 1u
40
- #define THREADS_MAX 0xFFFFFFFFu
35
+ #define MEMLIMIT_MIN 8u
36
+ #define MEMLIMIT_MAX UINT32_MAX
37
+ #define OPSLIMIT_MIN 1u
38
+ #define OPSLIMIT_MAX UINT32_MAX
39
+ #define THREADS_MIN 1u
40
+ #define THREADS_MAX UINT32_MAX
41
41
42
+ #define ARGON_VERSION 0x13
43
+
44
+ #define SALT_SIZE 16
45
+ #define HASH_SIZE 32
46
+ #define DIGEST_SIZE 128
42
47
43
48
static inline int get_options (zend_array * options , uint32_t * memlimit , uint32_t * opslimit , uint32_t * threads )
44
49
{
@@ -79,10 +84,6 @@ static inline int get_options(zend_array *options, uint32_t *memlimit, uint32_t
79
84
return SUCCESS ;
80
85
}
81
86
82
- #define SALT_SIZE 16
83
- #define HASH_SIZE 32
84
- #define DIGEST_SIZE 128
85
-
86
87
static bool php_openssl_argon2_compute_hash (
87
88
const char * algo ,
88
89
uint32_t version , uint32_t memlimit , uint32_t opslimit , uint32_t threads ,
@@ -141,11 +142,11 @@ static bool php_openssl_argon2_compute_hash(
141
142
142
143
static zend_string * php_openssl_argon2_hash (const zend_string * password , zend_array * options , const char * algo )
143
144
{
144
- uint32_t opslimit , memlimit , threads , version = 0x13 ;
145
+ uint32_t opslimit , memlimit , threads , version = ARGON_VERSION ;
145
146
zend_string * digest = NULL , * salt64 = NULL , * hash64 = NULL ;
146
147
unsigned char hash [HASH_SIZE + 1 ], salt [SALT_SIZE + 1 ];
147
148
148
- if ((ZSTR_LEN (password ) >= 0xffffffff )) {
149
+ if ((ZSTR_LEN (password ) >= UINT32_MAX )) {
149
150
zend_value_error ("Password is too long" );
150
151
return NULL ;
151
152
}
@@ -161,7 +162,7 @@ static zend_string *php_openssl_argon2_hash(const zend_string *password, zend_ar
161
162
return NULL ;
162
163
}
163
164
164
- hash64 = php_base64_encode (hash , sizeof ( hash ) - 1 );
165
+ hash64 = php_base64_encode (hash , HASH_SIZE );
165
166
/* No padding utsing 32 *4 / 3 = 42.6 (43 + 1 padding char) */
166
167
ZEND_ASSERT (ZSTR_LEN (hash64 )== 44 && ZSTR_VAL (hash64 )[43 ]== '=' );
167
168
ZSTR_VAL (hash64 )[43 ] = 0 ;
@@ -237,7 +238,7 @@ static bool php_openssl_argon2_verify(const zend_string *password, const zend_st
237
238
zend_string * salt , * hash , * new ;
238
239
bool ret = false;
239
240
240
- if ((ZSTR_LEN (password ) >= 0xffffffff ) || (ZSTR_LEN (digest ) >= 0xffffffff )) {
241
+ if ((ZSTR_LEN (password ) >= UINT32_MAX ) || (ZSTR_LEN (digest ) >= UINT32_MAX )) {
241
242
return false;
242
243
}
243
244
if (FAILURE == php_openssl_argon2_extract (digest , & version , & memlimit , & opslimit , & threads , & salt , & hash )) {
@@ -271,7 +272,7 @@ static bool php_openssl_argon2id_verify(const zend_string *password, const zend_
271
272
static bool php_openssl_argon2_needs_rehash (const zend_string * hash , zend_array * options )
272
273
{
273
274
uint32_t version , opslimit , memlimit , threads ;
274
- uint32_t new_version = 0x13 , new_opslimit , new_memlimit , new_threads ;
275
+ uint32_t new_version = ARGON_VERSION , new_opslimit , new_memlimit , new_threads ;
275
276
276
277
if (FAILURE == get_options (options , & new_memlimit , & new_opslimit , & new_threads )) {
277
278
return true;
@@ -280,7 +281,7 @@ static bool php_openssl_argon2_needs_rehash(const zend_string *hash, zend_array
280
281
return true;
281
282
}
282
283
283
- // Algo checked before
284
+ // Algo already checked in pasword_needs_rehash implementation
284
285
return (version != new_version ) ||
285
286
(opslimit != new_opslimit ) ||
286
287
(memlimit != new_memlimit ) ||
@@ -289,7 +290,7 @@ static bool php_openssl_argon2_needs_rehash(const zend_string *hash, zend_array
289
290
290
291
static int php_openssl_argon2_get_info (zval * return_value , const zend_string * hash )
291
292
{
292
- uint32_t v = 0 , threads = 1 ;
293
+ uint32_t v , threads ;
293
294
uint32_t memory_cost ;
294
295
uint32_t time_cost ;
295
296
@@ -299,6 +300,7 @@ static int php_openssl_argon2_get_info(zval *return_value, const zend_string *ha
299
300
add_assoc_long (return_value , "memory_cost" , memory_cost );
300
301
add_assoc_long (return_value , "time_cost" , time_cost );
301
302
add_assoc_long (return_value , "threads" , threads );
303
+
302
304
return SUCCESS ;
303
305
}
304
306
@@ -333,7 +335,7 @@ static const php_password_algo openssl_algo_argon2id = {
333
335
334
336
PHP_FUNCTION (openssl_password_hash )
335
337
{
336
- zend_string * password , * algo , * digest = NULL ;
338
+ zend_string * password , * algo , * digest ;
337
339
zend_array * options = NULL ;
338
340
339
341
ZEND_PARSE_PARAMETERS_START (2 , 3 )
@@ -384,7 +386,7 @@ PHP_MINIT_FUNCTION(openssl_pwhash)
384
386
zend_register_functions (NULL , ext_functions , NULL , type );
385
387
386
388
if (php_password_algo_find (argon2i )) {
387
- /* Nothing to do. Core has registered these algorithms for us. */
389
+ /* Nothing to do. Core or sodium has registered these algorithms for us. */
388
390
zend_string_release (argon2i );
389
391
return SUCCESS ;
390
392
}
@@ -402,4 +404,10 @@ PHP_MINIT_FUNCTION(openssl_pwhash)
402
404
return SUCCESS ;
403
405
}
404
406
407
+ PHP_MSHUTDOWN_FUNCTION (openssl_pwhash )
408
+ {
409
+ zend_unregister_functions (ext_functions , -1 , NULL );
410
+
411
+ return SUCCESS ;
412
+ }
405
413
#endif /* PHP_OPENSSL_API_VERSION >= 0x30200 */
0 commit comments