[PHP-DEV] mcrypt

2002-07-30 Thread Purushotham Komaravolu

Hello, 
  I am getting some odd errors trying to get an encrypt/decrypt process to 
  work. Looking at the manual examples and some other literature, I have tried 
  the two approaches listed below. For each, I get a sometimes-works, 
  sometimes fails result. The manual entry has a string of user notes with 
  problem like mine, but I still have problems. 



  Server API Apache 



  mcrypt 
mcrypt support enabled 
version 2.4.x 
Supported ciphers twofish rijndael-128 rijndael-192 rijndael-256 
  saferplus rc2 xtea serpent safer-sk64 safer-sk128 cast-256 loki97 gost 
  threeway cast-128 des tripledes enigma arcfour panama wake 
Supported modes ofb cfb nofb cbc ecb stream 


  --] 



  The first attempt used the following code: 


  -- 
  ?php 
  $key = this is a secret key; 
  $input = Let us meet at 9 o'clock at the secret place.; 


  $td = mcrypt_module_open ('tripledes', '', 'ecb', ''); 
  $iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td), MCRYPT_RAND); 
  mcrypt_generic_init ($td, $key, $iv); 
  $encrypted_data = mcrypt_generic ($td, $input); 
  $decrypted_data = mdecrypt_generic ($td, $encrypted_data); 
  mcrypt_generic_end ($td); 


echo key: 
  $keybrinput:$inputbrencrypted:$encrypted_databrdecrypted:$decrypted_da 
  ta; 
  ? 
  --] 


  This resulted, at first, in key: this is a secret key 
  input:Let us meet at 9 o'clock at the secret place. 
  encrypted:\ºþêTÏ'áz(v¹FýaõFËU³æç SäÇÚÖzßù5Qì±_T-:Í 
  decrypted:Let us meet at 9 o'clock at the secret place. 


  BUT after I refreshed/reloaded a couple of times, I got this: Warning: 
  mcrypt_generic_init: Memory allocation error in 
  /home/pndrdrm001/www/administrator/crypt.php on line 64 


  Warning: 1 is not a valid MCrypt resource in 
  /home/pndrdrm001/www/administrator/crypt.php on line 65 


  Warning: 1 is not a valid MCrypt resource in 
  /home/pndrdrm001/www/administrator/crypt.php on line 66 


  Warning: 1 is not a valid MCrypt resource in 
  /home/pndrdrm001/www/administrator/crypt.php on line 67 
  key: this is a secret key 
  input:Let us meet at 9 o'clock at the secret place. 
  encrypted: 
  decrypted:  


  There were no changes to the code. 



  The second try used the following: 


  In file 1, the functions: 
  -- 
  ?php 


   function my_encrypt($sString) 
   { 
GLOBAL $sCryptoKey; 


$iIV = mcrypt_create_iv (mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, 
  MCRYPT_MODE_ECB), MCRYPT_RAND); 


$sEncrypted = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $sCryptoKey, $sString, 
  MCRYPT_MODE_ECB, $iIV); 


return($sEncrypted); 
   } // End function my_encrypt 


   function my_decrypt($sString) 
   { 
GLOBAL $sCryptoKey; 


$iIV = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, 
  MCRYPT_MODE_ECB), MCRYPT_RAND); 


$sDecrypted = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $sCryptoKey, $sString, 
  MCRYPT_MODE_ECB, $iIV); 


return(trim($sDecrypted)); 


   } // End function my_decrypt 
  ? 
  --] 
  and in file 2, the main page: 
  -- 
  ?php 
include cryption.php; 
$sCryptoKey = key; 
$input = test; 
$encrypted = my_encrypt($input); 
$decrypted = my_decrypt($encrypted); 


echo key: 
  $sCryptoKeybrinput:$inputbrencrypted:$encryptedbrdecrypted:$decrypted 
  ; 



  ? 
  --] 


  This resulted in key: key 
  input:test 
  encrypted: foUÝø§ª~RM¡°Kz à¼O¼¿rwx@nÉ 
  decrypted:test  the first time, but then I got Fatal error: generic_init 
  failed in /home/pndrdrm001/www/administrator/cryption.php on line 9 on the 
  second refresh. 



  Is there a missing call to free resources, or something? What can be done? 


  Thanks! 
  Regards,

  Puru

 




[PHP-DEV] Mcrypt compile error in CVS

2002-05-30 Thread Mitch Vincent


I have the algos compiled into the mcrypt library (needed to have it work
with OS X) and get this when I try to compile the latest CVS pf PHP..

Just an FYI -- thanks!

/usr/local/download/php4/ext/mcrypt/mcrypt.c:222: warning: `MCRYPT_FAILED'
redefined
/usr/local/include/mcrypt.h:30: warning: this is the location of the
previous definition
/usr/local/download/php4/ext/mcrypt/mcrypt.c: In function
`zm_startup_mcrypt':
/usr/local/download/php4/ext/mcrypt/mcrypt.c:272: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:273: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:274: `MCRYPT_BLOWFISH_128'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:274: (Each undeclared
identifier is reported only once
/usr/local/download/php4/ext/mcrypt/mcrypt.c:274: for each function it
appears in.)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:275: `MCRYPT_BLOWFISH_192'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:276: `MCRYPT_BLOWFISH_256'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:277: `MCRYPT_BLOWFISH_448'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:278: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:279: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:280: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:281: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:282: `MCRYPT_IDEA' undeclared
(first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:283: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:284: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:285: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:286: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:287: `MCRYPT_RC2_128'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:288: `MCRYPT_RC2_256'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:289: `MCRYPT_RC2_1024'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:290: `MCRYPT_RC4' undeclared
(first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:291: `MCRYPT_RC6_128'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:292: `MCRYPT_RC6_192'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:293: `MCRYPT_RC6_256'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:294: `MCRYPT_SAFER_64'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:295: `MCRYPT_SAFER_128'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:296: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c:297: `MCRYPT_SERPENT_128'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:298: `MCRYPT_SERPENT_192'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:299: `MCRYPT_SERPENT_256'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:300: `MCRYPT_TWOFISH_128'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:301: `MCRYPT_TWOFISH_192'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:302: `MCRYPT_TWOFISH_256'
undeclared (first use in this function)
/usr/local/download/php4/ext/mcrypt/mcrypt.c:303: warning: passing arg 3 of
`zend_register_long_constant' makes integer from pointer without a cast
/usr/local/download/php4/ext/mcrypt/mcrypt.c: In function
`zif_mcrypt_get_cipher_name':
/usr/local/download/php4/ext/mcrypt/mcrypt.c:1497: warning: assignment makes
pointer from integer without a cast
make: *** [ext/mcrypt/mcrypt.lo] Error 1


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, visit: http://www.php.net/unsub.php




Re: [PHP-DEV] mcrypt issues

2001-08-24 Thread derick

Hello,

crashes that are related to closing modules are probably because a change
in the mcrypt library... I just found this in the manual:

   The library is closed by calling mcrypt_module_close(), but you should
   not call that function if mcrypt_generic_end() is called before.

and:

   int mcrypt_generic_end( MCRYPT td);

   This function terminates  encryption  specified  by the
   encryption descriptor (td). Actually it clears all buffers, and
   closes  all  the  modules  used. Returns a negative value
   on error. This function is deprecated. Use
   mcrypt_generic_deinit() and mcrypt_module_close() instead.


In earlier versions this was neccesairy, but now it can cause crashes. If
I find some more time (hopefully this weekend), I'll dig in it.

regards,
Derick

On Thu, 23 Aug 2001, Michael S. Fischer wrote:

 Would anyone care to comment on this thread?  Seems we've uncovered yet
 another mcrypt-related bug in PHP 4.0.6.

 Thanks,

 --Michael

 -Original Message-
 From: Dathan Pattishall
 Sent: Thursday, August 23, 2001 10:44 AM
 To: RO - Sever Filoti; Dathan Pattishall
 Cc: Drew Folta; ACP-Split
 Subject: RE: I think I found a mcrypt work around


 Actually I should of went into more detail, about the work around. I did the
 same thing but did not make the open call global. I committed the changes to
 the splitdb gate, and have it working on realacp06 and realacp08. Take a
 look at url_encode.inc now, and see if the seg fault is still troubling you.


 Great digging, and thanks for the follow up!

 --
 D

 |~-Original Message-
 |~From: Sever Filoti [mailto:[EMAIL PROTECTED]]
 |~Sent: Wednesday, August 22, 2001 11:42 PM
 |~To: Dathan Pattishall
 |~Cc: Drew Folta; ACP-Split
 |~Subject: Re: I think I found a mcrypt work around
 |~Importance: High
 |~
 |~
 |~Actually I did this kind of digging myself some time ago, but it was
 |~before ticket code push so I didn't get the time to publish
 |~the results.
 |~
 |~Anyway, only commenting mcrypt_generic_end did not do the
 |~trick for me,
 |~apache still segfaulted... strange.
 |~Then I've put the initialization part at global level:
 |~
 |~$__encode_td = mcrypt_module_open (MCRYPT_DES, ,
 |~MCRYPT_MODE_ECB, );
 |~
 |~$__encode_iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td),
 |~MCRYPT_RAND);
 |~
 |~and reused these variables in called function, as well as removing the
 |~generic_end call.
 |~
 |~Apache stopped segfaulting, and I even ran an ab (apache
 |~benchmark) on a
 |~shop page, thousands of iterations and no segfault :-), also no memory
 |~leaks did occur during the benchmark.
 |~
 |~As about the speed, Dathan is right: module_open/generic_end
 |~translates
 |~in having mcrypt library do dlopen (scan for libs...) on cipher
 |~libraries, allocate buffers, then deallocate buffers and
 |~unload (dlcose)
 |~the modules;  this would happen per obfuscated link so it's very
 |~expensive.
 |~
 |~I guess what happens is that after the two mcrypt modules (tripledes,
 |~ecb) are loaded, another .so it's needed and hence loaded;  but after
 |~encryption ends and generic_end tries to unload explicitly
 |~(dlclose) the
 |~mcrypt module, dynamic loader whines cannot close resident
 |~module, and
 |~probably next encryption step works with same module loaded but with
 |~encryption buffers drained and this leads to signal 11.
 |~
 |~Next 'mistery': apache stopped segfaulting but with the hacked code
 |~tested with ab I could see in apache's error log messages like:
 |~
 |~[Thu Aug 16 01:27:09 2001] [notice] child pid 729 exit signal Aborted
 |~(6)
 |~apache: dl-close.c:119: _dl_close: Assertion `new_opencount[0] == 0'
 |~failed.
 |~[Thu Aug 16 01:27:20 2001] [notice] child pid 724 exit signal Aborted
 |~(6)
 |~
 |~A failed assertion, probably related to shared libraries loading /
 |~unloading as well.   Fortunately, seems to happen only when an apache
 |~process exists, thus has no user visible effects (response already
 |~sent).
 |~
 |~Dathan Pattishall wrote:
 |~
 |~  Could be, I'll do a more in-depth analysis when I finish
 |~the aw_setup
 |~ script. But when these boxes have 2GB of memory and the apache is
 |~ restarted every day, I don't see this as being much of an issue
 |~ (short-term)
 |~
 |~  -Original Message-
 |~  From: Drew Folta
 |~  Sent: Wednesday, August 22, 2001 3:46 PM
 |~  To: Dathan Pattishall; ACP-Split
 |~  Subject: RE: I think I found a mcrypt work around
 |~  Importance: High
 |~
 |~  OK, but are the apaches leaking memory (more than usual)
 |~  ?Drew
 |~
 |~   -Original Message-
 |~   From: Dathan Pattishall
 |~   Sent: Wednesday, August 22, 2001 3:27 PM
 |~   To: ACP-Split
 |~   Subject: I think I found a mcrypt work around
 |~
 |~   After doing some debugging and looking at
 |~   TripleDes, I ran across a resource re-allocate
 |~   function for mcrypt, called mcrypt_generic_end .
 |~  

[PHP-DEV] mcrypt: Unknown list entry type in request shutdown

2001-08-23 Thread Holger Schopohl

Hi 

CVS PHP notify:

Warning: Unknown list entry type in request shutdown

on each mcrypt_module_open() call.

i have test it on 2 diffrent systems under linux
and it each time the same ...

Regards,
-- 
Holger

-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




[PHP-DEV] mcrypt issues

2001-08-23 Thread Michael S. Fischer

Would anyone care to comment on this thread?  Seems we've uncovered yet
another mcrypt-related bug in PHP 4.0.6.

Thanks,

--Michael

-Original Message-
From: Dathan Pattishall 
Sent: Thursday, August 23, 2001 10:44 AM
To: RO - Sever Filoti; Dathan Pattishall
Cc: Drew Folta; ACP-Split
Subject: RE: I think I found a mcrypt work around


Actually I should of went into more detail, about the work around. I did the
same thing but did not make the open call global. I committed the changes to
the splitdb gate, and have it working on realacp06 and realacp08. Take a
look at url_encode.inc now, and see if the seg fault is still troubling you.


Great digging, and thanks for the follow up!

--
D

|~-Original Message-
|~From: Sever Filoti [mailto:[EMAIL PROTECTED]]
|~Sent: Wednesday, August 22, 2001 11:42 PM
|~To: Dathan Pattishall
|~Cc: Drew Folta; ACP-Split
|~Subject: Re: I think I found a mcrypt work around
|~Importance: High
|~
|~
|~Actually I did this kind of digging myself some time ago, but it was
|~before ticket code push so I didn't get the time to publish 
|~the results.
|~
|~Anyway, only commenting mcrypt_generic_end did not do the 
|~trick for me,
|~apache still segfaulted... strange.
|~Then I've put the initialization part at global level:
|~
|~$__encode_td = mcrypt_module_open (MCRYPT_DES, , 
|~MCRYPT_MODE_ECB, );
|~
|~$__encode_iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td),
|~MCRYPT_RAND);
|~
|~and reused these variables in called function, as well as removing the
|~generic_end call.
|~
|~Apache stopped segfaulting, and I even ran an ab (apache 
|~benchmark) on a
|~shop page, thousands of iterations and no segfault :-), also no memory
|~leaks did occur during the benchmark.
|~
|~As about the speed, Dathan is right: module_open/generic_end 
|~translates
|~in having mcrypt library do dlopen (scan for libs...) on cipher
|~libraries, allocate buffers, then deallocate buffers and 
|~unload (dlcose)
|~the modules;  this would happen per obfuscated link so it's very
|~expensive.
|~
|~I guess what happens is that after the two mcrypt modules (tripledes,
|~ecb) are loaded, another .so it's needed and hence loaded;  but after
|~encryption ends and generic_end tries to unload explicitly 
|~(dlclose) the
|~mcrypt module, dynamic loader whines cannot close resident 
|~module, and
|~probably next encryption step works with same module loaded but with
|~encryption buffers drained and this leads to signal 11.
|~
|~Next 'mistery': apache stopped segfaulting but with the hacked code
|~tested with ab I could see in apache's error log messages like:
|~
|~[Thu Aug 16 01:27:09 2001] [notice] child pid 729 exit signal Aborted
|~(6)
|~apache: dl-close.c:119: _dl_close: Assertion `new_opencount[0] == 0'
|~failed.
|~[Thu Aug 16 01:27:20 2001] [notice] child pid 724 exit signal Aborted
|~(6)
|~
|~A failed assertion, probably related to shared libraries loading /
|~unloading as well.   Fortunately, seems to happen only when an apache
|~process exists, thus has no user visible effects (response already
|~sent).
|~
|~Dathan Pattishall wrote:
|~
|~  Could be, I'll do a more in-depth analysis when I finish 
|~the aw_setup
|~ script. But when these boxes have 2GB of memory and the apache is
|~ restarted every day, I don't see this as being much of an issue
|~ (short-term)
|~
|~  -Original Message-
|~  From: Drew Folta
|~  Sent: Wednesday, August 22, 2001 3:46 PM
|~  To: Dathan Pattishall; ACP-Split
|~  Subject: RE: I think I found a mcrypt work around
|~  Importance: High
|~
|~  OK, but are the apaches leaking memory (more than usual)
|~  ?Drew
|~
|~   -Original Message-
|~   From: Dathan Pattishall
|~   Sent: Wednesday, August 22, 2001 3:27 PM
|~   To: ACP-Split
|~   Subject: I think I found a mcrypt work around
|~
|~   After doing some debugging and looking at
|~   TripleDes, I ran across a resource re-allocate
|~   function for mcrypt, called mcrypt_generic_end .
|~   To me this sounds like some sort of destructor
|~   that is going out of bounds and attempts to modify
|~   memory that the resource does not own, i.e.. the
|~   cause of the seg-fault.So, I turned that option
|~   off, and just allow Zend / Apache control it's own
|~   resources, and low-en-behold the seg fault stops,
|~   page rendering is 3 times faster, and I'm much
|~   happier.if (PHP_VERSION  3) {
|~ $td = mcrypt_module_open (MCRYPT_DES, ,
|~   MCRYPT_MODE_ECB, );
|~ $iv = mcrypt_create_iv
|~   (mcrypt_enc_get_iv_size ($td), MCRYPT_RAND);
|~ mcrypt_generic_init ($td, $__key, $iv);
|~ $query_string = mdecrypt_generic ($td, $s);
|~ //mcrypt_generic_end ($td);
|~   } else {
|~ $query_string = mcrypt_ecb(MCRYPT_TripleDES,
|~   $__key, $s, 

Re: [PHP-DEV] mcrypt broken?

2001-08-18 Thread Derick Rethans

On Sat, 18 Aug 2001, Anil Madhavapeddy wrote:

 Testing PHP-4.0.7RC1 on OpenBSD-2.9, w/ libmcrypt-2.4.15

 Mcrypt seems a bit broken; even calling nothing but mcrypt_module_open
 results in Warning: Unknown list entry type in request shutdown (0) in ...

 Anyone else seeing this problem?

I'm going to work on the mcrypt thingy's today, there are lots of bugs in
it. IIRC this bug was already posted to the bug system too.

Derick


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




[PHP-DEV] mcrypt broken?

2001-08-17 Thread Anil Madhavapeddy

Testing PHP-4.0.7RC1 on OpenBSD-2.9, w/ libmcrypt-2.4.15

Mcrypt seems a bit broken; even calling nothing but mcrypt_module_open
results in Warning: Unknown list entry type in request shutdown (0) in ...

Anyone else seeing this problem?

Anil

-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




[PHP-DEV] mcrypt failure under PHP 4.0.5 - more info.

2001-05-17 Thread Chris Walker

Hi fellow developers,

RE: mcrypt functionality failure since PHP 4.0.5 upgrade.

This is a snippet taken from the class that handles the addition of
new users into the users table. It shows the way we *were
successfully* using mcrypt to encrypt user's passwords:

//--- Begin code paste.

   $password_key = md5($username);

   // Actual passwords are randomly generated.
   // User may change later.

   srand((double)microtime()*100);
   $password = substr(md5(rand(0,999)),0,8);

   // Encrypt password using md5 string above.

   $td = mcrypt_module_open (MCRYPT_TripleDES, , MCRYPT_MODE_ECB, );
   $iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td), MCRYPT_RAND);
   mcrypt_generic_init ($td, $password_key, $iv);
   $encrypted_password = mcrypt_generic ($td,$password);
   mcrypt_generic_end ($td);

   // Do database insert using $encrypted_password value.

//--- End code paste.

The rest is irrelevant. Up until the upgrade to PHP 4.0.5, the above
method worked without any issue, each time returning properly
encrypted passwords which were then stored in the database.

At the moment passwords are now being stored unencrypted but since its
currently on an internal development server the security implications
are negligible, BUT I would appreciate any feedback, similar
encounters, etc from the development community since this clearly
needs fixing.

Many thanks,

Chris.



-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




Fwd: [PHP-DEV] mcrypt failure under PHP 4.0.5 - more info.

2001-05-17 Thread Andi Gutmans

Sascha,

Can you please check this out? It should probably be fixed for 4.0.6.

Andi

Delivered-To: [EMAIL PROTECTED]
Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm
list-post: mailto:[EMAIL PROTECTED]
Delivered-To: mailing list [EMAIL PROTECTED]
Date: Thu, 17 May 2001 16:48:36 +0100
From: Chris Walker [EMAIL PROTECTED]
X-Mailer: The Bat! (v1.51) Personal
Reply-To: Chris Walker [EMAIL PROTECTED]
Organization: Gameshrine
To: [EMAIL PROTECTED]
Subject: [PHP-DEV] mcrypt failure under PHP 4.0.5 - more info.

Hi fellow developers,

RE: mcrypt functionality failure since PHP 4.0.5 upgrade.

This is a snippet taken from the class that handles the addition of
new users into the users table. It shows the way we *were
successfully* using mcrypt to encrypt user's passwords:

//--- Begin code paste.

$password_key = md5($username);

// Actual passwords are randomly generated.
// User may change later.

srand((double)microtime()*100);
$password = substr(md5(rand(0,999)),0,8);

// Encrypt password using md5 string above.

$td = mcrypt_module_open (MCRYPT_TripleDES, , MCRYPT_MODE_ECB, );
$iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td), MCRYPT_RAND);
mcrypt_generic_init ($td, $password_key, $iv);
$encrypted_password = mcrypt_generic ($td,$password);
mcrypt_generic_end ($td);

// Do database insert using $encrypted_password value.

//--- End code paste.

The rest is irrelevant. Up until the upgrade to PHP 4.0.5, the above
method worked without any issue, each time returning properly
encrypted passwords which were then stored in the database.

At the moment passwords are now being stored unencrypted but since its
currently on an internal development server the security implications
are negligible, BUT I would appreciate any feedback, similar
encounters, etc from the development community since this clearly
needs fixing.

Many thanks,

Chris.



--
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




Re: Fwd: [PHP-DEV] mcrypt failure under PHP 4.0.5 - more info.

2001-05-17 Thread derick

On Thu, 17 May 2001, Andi Gutmans wrote:

 Sascha,

 Can you please check this out? It should probably be fixed for 4.0.6.

The code he pasted gives me a nice segfault:

Program received signal SIGSEGV, Segmentation fault.
permute (inblock=0x81ac1e4 6866206b\204Ì\217*, perm=0x1980,
outblock=0xbfffe424 ) at tripledes.c:628
628 *ob++ |= *p++ | *q++;
(gdb) bt
#0  permute (inblock=0x81ac1e4 6866206b\204Ì\217*, perm=0x1980,
outblock=0xbfffe424 ) at tripledes.c:628
#1  0x405b32da in tripledes_LTX__mcrypt_encrypt (key=0x0,
block=0x81ac1e4 6866206b\204Ì\217*) at tripledes.c:319
#2  0x400189da in ecb_LTX__mcrypt (ign=0x0, plaintext=0x81ac1e4, len=8,
blocksize=8, akey=0x0, func=0x405b32ac
tripledes_LTX__mcrypt_encrypt,
func2=0x405b37d8 tripledes_LTX__mcrypt_decrypt) at ecb.c:55
#3  0x40161a09 in mcrypt (td=0x8235ac0, buf=0x0, a=0x81ac1e4, b=8)
at mcrypt_modules.c:377
#4  0x401610ee in mcrypt_generic (td=0x8235ac0, plaintext=0x81ac1e4,
len=8)
at mcrypt.c:152
#5  0x80743d8 in php_if_mcrypt_generic (ht=2, return_value=0x82358a4,
this_ptr=0x0, return_value_used=1) at mcrypt.c:518
#6  0x814f211 in execute (op_array=0x8203a24) at ./zend_execute.c:1504
#7  0x8114b3b in zend_execute_scripts (type=8, file_count=3) at zend.c:748
#8  0x8066fec in php_execute_script (primary_file=0xbac4) at
main.c:1206
#9  0x8065291 in main (argc=1, argv=0xbb24) at cgi_main.c:717
#10 0x402fb9cb in __libc_start_main (main=0x8064bf4 main, argc=1,
argv=0xbb24, init=0x8062e88 _init, fini=0x8154b2c _fini,
rtld_fini=0x4000ae60 _dl_fini, stack_end=0xbb1c)
at ../sysdeps/generic/libc-start.c:92

It seems to me that a NULL pointer as key is passed to mcrypt.

I'll have a look at the code later this evening.

Derick

Derick Rethans

-
PHP: Scripting the Web - www.php.net - [EMAIL PROTECTED]
 SRM: Site Resource Manager - www.vl-srm.net
-


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




Re: [PHP-DEV] mcrypt

2001-03-05 Thread Derick Rethans

On Mon, 5 Mar 2001, Cameron wrote:

 when are the bugs with the latest mcrypt going to be fixed?!?

When I can find a little time for it, and I don't have much of it right
now.

Derick Rethans

-
PHP: Scripting the Web - www.php.net - [EMAIL PROTECTED]
 SRM: Site Resource Manager - www.vl-srm.net
-


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




[PHP-DEV] mcrypt

2001-03-04 Thread Cameron

when are the bugs with the latest mcrypt going to be fixed?!?


Cameron


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




[PHP-DEV] mcrypt

2001-03-02 Thread Cameron

any ideas on when mcrypt will be patched up for the latest version? also
what about a date for RC1 ?


Cameron Brunner


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




RE: [PHP-DEV] mcrypt oracle 81

2001-01-22 Thread Vinod Panicker

the server does not log anything.  when i ran it under gdb, it says that
php4 is using plain Apache 1.3 API and is asking me to recompile with -DEAPI
now where do i give that?

thanks...

-Original Message-
From: Derick Rethans [mailto:[EMAIL PROTECTED]]
Sent: Monday, January 22, 2001 2:40 PM
To: Vinod Panicker
Cc: php-dev
Subject: Re: [PHP-DEV] mcrypt  oracle 81


Hello,

please provide more information, such as a backtrace and the messages in
your error_log (of your webserver).

Derick

On Mon, 22 Jan 2001, Vinod Panicker wrote:

 hey..
 i'm trying to get PHP 4.0.4pl1 working with mcrypt 2.4.7 and oracle
 8i...
 problem is that everything gets configured and make works too... but after
 that when i start apache, it just dies.  i'm using apache 1.3.14.

 anybody tried this before?  pls help me out if u can...


 --
 PHP Development Mailing List http://www.php.net/
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 To contact the list administrators, e-mail: [EMAIL PROTECTED]


Derick Rethans

-
  PHP: Scripting the Web - www.php.net - [EMAIL PROTECTED]
-
JDI Media Solutions - www.jdimedia.nl - [EMAIL PROTECTED]
 H.v. Tussenbroekstraat 1 - 6952 BL Dieren - The Netherlands
-


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




RE: [PHP-DEV] mcrypt oracle 81

2001-01-22 Thread Vinod Panicker

no error messages, no logged errors, no segfault.  I configured PHP as a DSO
and the Oracle environment vars are set.
I ran httpd under gdb and it told me that PHP is using a Apache 1.3 API
which might cause it to crash and told me to recompile it with -DEAPI.  Now
where do i give this option and to what?  while configuring apache or php?

thanks..

-Original Message-
From: Paul Mindeman [mailto:[EMAIL PROTECTED]]
Sent: Monday, January 22, 2001 8:36 PM
To: [EMAIL PROTECTED]
Subject: Re: [PHP-DEV] mcrypt  oracle 81


Vinod Panicker wrote:

 hey..
 i'm trying to get PHP 4.0.4pl1 working with mcrypt 2.4.7 and oracle
 8i...
 problem is that everything gets configured and make works too... but after
 that when i start apache, it just dies.  i'm using apache 1.3.14.

 anybody tried this before?  pls help me out if u can...


Do you get an error message when you start apache? If so, what is it?
Are you building PHP as a static module, or as a DSO?  Did you remember
to set your Oracle environment variables before starting apache?


--
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]




Re: [PHP-DEV] mcrypt oracle 81

2001-01-21 Thread Derick Rethans

Hello,

please provide more information, such as a backtrace and the messages in
your error_log (of your webserver).

Derick

On Mon, 22 Jan 2001, Vinod Panicker wrote:

 hey..
 i'm trying to get PHP 4.0.4pl1 working with mcrypt 2.4.7 and oracle
 8i...
 problem is that everything gets configured and make works too... but after
 that when i start apache, it just dies.  i'm using apache 1.3.14.

 anybody tried this before?  pls help me out if u can...


 --
 PHP Development Mailing List http://www.php.net/
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 To contact the list administrators, e-mail: [EMAIL PROTECTED]


Derick Rethans

-
  PHP: Scripting the Web - www.php.net - [EMAIL PROTECTED]
-
JDI Media Solutions - www.jdimedia.nl - [EMAIL PROTECTED]
 H.v. Tussenbroekstraat 1 - 6952 BL Dieren - The Netherlands
-


-- 
PHP Development Mailing List http://www.php.net/
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]