History log of /PHP-8.3/ext/mysqli/tests/gh11438.phpt (Results 1 – 2 of 2)
Revision Date Author Comments
# 162bd2a5 03-Aug-2023 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Fix missing link variable in test


# 509906b2 12-Jun-2023 Niels Dossche <7771979+nielsdos@users.noreply.github.com>

Fix GH-11438: mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters

https://dev.mysql.com/doc/dev/mysql-server/latest/page_caching_sha2_authen

Fix GH-11438: mysqlnd fails to authenticate with sha256_password accounts using passwords longer than 19 characters

https://dev.mysql.com/doc/dev/mysql-server/latest/page_caching_sha2_authentication_exchanges.html
tells us that the nonce used in this authentication method is 20 bytes
long. However, we might receive additional scramble data in
php_mysqlnd_greet_read not used in this method.
On my test setup, I received 21 bytes (20 bytes + '\0'). This resulted
in the xor computation to incorrectly include the NUL byte. Every
password of at least 20 characters therefore failed to authenticate
using this method.

Looking at mysql-server source code also seems to reveal that it always
uses a fixed number of scramble bytes [1].

[1] https://github.com/mysql/mysql-server/blob/ea7087d885006918ad54458e7aad215b1650312c/sql/auth/sha2_password.cc#L1078-L1079

Closes GH-11445.

Co-authored-by: Kamil Tekiela <tekiela246@gmail.com>

show more ...