xref: /PHP-8.0/ext/standard/crypt_sha512.c (revision b3569865)
1 /* SHA512-based Unix crypt implementation.
2    Released into the Public Domain by Ulrich Drepper <drepper@redhat.com>.  */
3 /* Windows VC++ port by Pierre Joye <pierre@php.net> */
4 
5 #include "php.h"
6 #include "php_main.h"
7 
8 #include <errno.h>
9 #include <limits.h>
10 #ifdef PHP_WIN32
11 # define __alignof__ __alignof
12 # define alloca _alloca
13 #else
14 # ifndef HAVE_ALIGNOF
15 #  include <stddef.h>
16 #  define __alignof__(type) offsetof (struct { char c; type member;}, member)
17 # endif
18 #endif
19 
20 #include <stdio.h>
21 #include <stdlib.h>
22 
23 #ifdef PHP_WIN32
24 # include <string.h>
25 #else
26 # include <sys/param.h>
27 # include <sys/types.h>
28 # include <string.h>
29 #endif
30 
31 extern void * __php_mempcpy(void * dst, const void * src, size_t len);
32 extern char * __php_stpncpy(char *dst, const char *src, size_t len);
33 
34 #ifndef MIN
35 # define MIN(a, b) (((a) < (b)) ? (a) : (b))
36 #endif
37 #ifndef MAX
38 # define MAX(a, b) (((a) > (b)) ? (a) : (b))
39 #endif
40 
41 /* See #51582 */
42 #ifndef UINT64_C
43 # define UINT64_C(value) __CONCAT(value, ULL)
44 #endif
45 
46 /* Structure to save state of computation between the single steps.  */
47 struct sha512_ctx
48 {
49 	uint64_t H[8];
50 
51 	uint64_t total[2];
52 	uint64_t buflen;
53 	char buffer[256];	/* NB: always correctly aligned for uint64_t.  */
54 };
55 
56 
57 #if defined(PHP_WIN32) || (!defined(WORDS_BIGENDIAN))
58 # define SWAP(n) \
59   (((n) << 56)					\
60    | (((n) & 0xff00) << 40)			\
61    | (((n) & 0xff0000) << 24)			\
62    | (((n) & 0xff000000) << 8)			\
63    | (((n) >> 8) & 0xff000000)			\
64    | (((n) >> 24) & 0xff0000)			\
65    | (((n) >> 40) & 0xff00)			\
66    | ((n) >> 56))
67 #else
68 # define SWAP(n) (n)
69 #endif
70 
71 /* This array contains the bytes used to pad the buffer to the next
72    64-byte boundary.  (FIPS 180-2:5.1.2)  */
73 static const unsigned char fillbuf[128] = { 0x80, 0 /* , 0, 0, ...  */ };
74 
75 /* Constants for SHA512 from FIPS 180-2:4.2.3.  */
76 static const uint64_t K[80] = {
77 	UINT64_C (0x428a2f98d728ae22), UINT64_C (0x7137449123ef65cd),
78 	UINT64_C (0xb5c0fbcfec4d3b2f), UINT64_C (0xe9b5dba58189dbbc),
79 	UINT64_C (0x3956c25bf348b538), UINT64_C (0x59f111f1b605d019),
80 	UINT64_C (0x923f82a4af194f9b), UINT64_C (0xab1c5ed5da6d8118),
81 	UINT64_C (0xd807aa98a3030242), UINT64_C (0x12835b0145706fbe),
82 	UINT64_C (0x243185be4ee4b28c), UINT64_C (0x550c7dc3d5ffb4e2),
83 	UINT64_C (0x72be5d74f27b896f), UINT64_C (0x80deb1fe3b1696b1),
84 	UINT64_C (0x9bdc06a725c71235), UINT64_C (0xc19bf174cf692694),
85 	UINT64_C (0xe49b69c19ef14ad2), UINT64_C (0xefbe4786384f25e3),
86 	UINT64_C (0x0fc19dc68b8cd5b5), UINT64_C (0x240ca1cc77ac9c65),
87 	UINT64_C (0x2de92c6f592b0275), UINT64_C (0x4a7484aa6ea6e483),
88 	UINT64_C (0x5cb0a9dcbd41fbd4), UINT64_C (0x76f988da831153b5),
89 	UINT64_C (0x983e5152ee66dfab), UINT64_C (0xa831c66d2db43210),
90 	UINT64_C (0xb00327c898fb213f), UINT64_C (0xbf597fc7beef0ee4),
91 	UINT64_C (0xc6e00bf33da88fc2), UINT64_C (0xd5a79147930aa725),
92 	UINT64_C (0x06ca6351e003826f), UINT64_C (0x142929670a0e6e70),
93 	UINT64_C (0x27b70a8546d22ffc), UINT64_C (0x2e1b21385c26c926),
94 	UINT64_C (0x4d2c6dfc5ac42aed), UINT64_C (0x53380d139d95b3df),
95 	UINT64_C (0x650a73548baf63de), UINT64_C (0x766a0abb3c77b2a8),
96 	UINT64_C (0x81c2c92e47edaee6), UINT64_C (0x92722c851482353b),
97 	UINT64_C (0xa2bfe8a14cf10364), UINT64_C (0xa81a664bbc423001),
98 	UINT64_C (0xc24b8b70d0f89791), UINT64_C (0xc76c51a30654be30),
99 	UINT64_C (0xd192e819d6ef5218), UINT64_C (0xd69906245565a910),
100 	UINT64_C (0xf40e35855771202a), UINT64_C (0x106aa07032bbd1b8),
101 	UINT64_C (0x19a4c116b8d2d0c8), UINT64_C (0x1e376c085141ab53),
102 	UINT64_C (0x2748774cdf8eeb99), UINT64_C (0x34b0bcb5e19b48a8),
103 	UINT64_C (0x391c0cb3c5c95a63), UINT64_C (0x4ed8aa4ae3418acb),
104 	UINT64_C (0x5b9cca4f7763e373), UINT64_C (0x682e6ff3d6b2b8a3),
105 	UINT64_C (0x748f82ee5defb2fc), UINT64_C (0x78a5636f43172f60),
106 	UINT64_C (0x84c87814a1f0ab72), UINT64_C (0x8cc702081a6439ec),
107 	UINT64_C (0x90befffa23631e28), UINT64_C (0xa4506cebde82bde9),
108 	UINT64_C (0xbef9a3f7b2c67915), UINT64_C (0xc67178f2e372532b),
109 	UINT64_C (0xca273eceea26619c), UINT64_C (0xd186b8c721c0c207),
110 	UINT64_C (0xeada7dd6cde0eb1e), UINT64_C (0xf57d4f7fee6ed178),
111 	UINT64_C (0x06f067aa72176fba), UINT64_C (0x0a637dc5a2c898a6),
112 	UINT64_C (0x113f9804bef90dae), UINT64_C (0x1b710b35131c471b),
113 	UINT64_C (0x28db77f523047d84), UINT64_C (0x32caab7b40c72493),
114 	UINT64_C (0x3c9ebe0a15c9bebc), UINT64_C (0x431d67c49c100d4c),
115 	UINT64_C (0x4cc5d4becb3e42b6), UINT64_C (0x597f299cfc657e2a),
116 	UINT64_C (0x5fcb6fab3ad6faec), UINT64_C (0x6c44198c4a475817)
117   };
118 
119 
120 /* Process LEN bytes of BUFFER, accumulating context into CTX.
121    It is assumed that LEN % 128 == 0.  */
122 static void
sha512_process_block(const void * buffer,size_t len,struct sha512_ctx * ctx)123 sha512_process_block(const void *buffer, size_t len, struct sha512_ctx *ctx) {
124 	const uint64_t *words = buffer;
125 	size_t nwords = len / sizeof(uint64_t);
126 	uint64_t a = ctx->H[0];
127 	uint64_t b = ctx->H[1];
128 	uint64_t c = ctx->H[2];
129 	uint64_t d = ctx->H[3];
130 	uint64_t e = ctx->H[4];
131 	uint64_t f = ctx->H[5];
132 	uint64_t g = ctx->H[6];
133 	uint64_t h = ctx->H[7];
134 
135   /* First increment the byte count.  FIPS 180-2 specifies the possible
136 	 length of the file up to 2^128 bits.  Here we only compute the
137 	 number of bytes.  Do a double word increment.  */
138 	ctx->total[0] += len;
139 	if (ctx->total[0] < len) {
140 		++ctx->total[1];
141 	}
142 
143 	/* Process all bytes in the buffer with 128 bytes in each round of
144 	 the loop.  */
145 	while (nwords > 0) {
146 		uint64_t W[80];
147 		uint64_t a_save = a;
148 		uint64_t b_save = b;
149 		uint64_t c_save = c;
150 		uint64_t d_save = d;
151 		uint64_t e_save = e;
152 		uint64_t f_save = f;
153 		uint64_t g_save = g;
154 		uint64_t h_save = h;
155 		unsigned int t;
156 
157 /* Operators defined in FIPS 180-2:4.1.2.  */
158 #define Ch(x, y, z) ((x & y) ^ (~x & z))
159 #define Maj(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
160 #define S0(x) (CYCLIC (x, 28) ^ CYCLIC (x, 34) ^ CYCLIC (x, 39))
161 #define S1(x) (CYCLIC (x, 14) ^ CYCLIC (x, 18) ^ CYCLIC (x, 41))
162 #define R0(x) (CYCLIC (x, 1) ^ CYCLIC (x, 8) ^ (x >> 7))
163 #define R1(x) (CYCLIC (x, 19) ^ CYCLIC (x, 61) ^ (x >> 6))
164 
165 		/* It is unfortunate that C does not provide an operator for
166 		   cyclic rotation.  Hope the C compiler is smart enough.  */
167 #define CYCLIC(w, s) ((w >> s) | (w << (64 - s)))
168 
169 		/* Compute the message schedule according to FIPS 180-2:6.3.2 step 2.  */
170 		for (t = 0; t < 16; ++t) {
171 			W[t] = SWAP (*words);
172 			++words;
173 		}
174 
175 		for (t = 16; t < 80; ++t) {
176 			W[t] = R1 (W[t - 2]) + W[t - 7] + R0 (W[t - 15]) + W[t - 16];
177 		}
178 
179 		/* The actual computation according to FIPS 180-2:6.3.2 step 3.  */
180 		for (t = 0; t < 80; ++t) {
181 			uint64_t T1 = h + S1 (e) + Ch (e, f, g) + K[t] + W[t];
182 			uint64_t T2 = S0 (a) + Maj (a, b, c);
183 			h = g;
184 			g = f;
185 			f = e;
186 			e = d + T1;
187 			d = c;
188 			c = b;
189 			b = a;
190 			a = T1 + T2;
191 		}
192 
193 		/* Add the starting values of the context according to FIPS 180-2:6.3.2
194 		step 4.  */
195 		a += a_save;
196 		b += b_save;
197 		c += c_save;
198 		d += d_save;
199 		e += e_save;
200 		f += f_save;
201 		g += g_save;
202 		h += h_save;
203 
204 		/* Prepare for the next round.  */
205 		nwords -= 16;
206 	}
207 
208 	/* Put checksum in context given as argument.  */
209 	ctx->H[0] = a;
210 	ctx->H[1] = b;
211 	ctx->H[2] = c;
212 	ctx->H[3] = d;
213 	ctx->H[4] = e;
214 	ctx->H[5] = f;
215 	ctx->H[6] = g;
216 	ctx->H[7] = h;
217 }
218 
219 
220 /* Initialize structure containing state of computation.
221    (FIPS 180-2:5.3.3)  */
sha512_init_ctx(struct sha512_ctx * ctx)222 static void sha512_init_ctx (struct sha512_ctx *ctx) {
223 	ctx->H[0] = UINT64_C (0x6a09e667f3bcc908);
224 	ctx->H[1] = UINT64_C (0xbb67ae8584caa73b);
225 	ctx->H[2] = UINT64_C (0x3c6ef372fe94f82b);
226 	ctx->H[3] = UINT64_C (0xa54ff53a5f1d36f1);
227 	ctx->H[4] = UINT64_C (0x510e527fade682d1);
228 	ctx->H[5] = UINT64_C (0x9b05688c2b3e6c1f);
229 	ctx->H[6] = UINT64_C (0x1f83d9abfb41bd6b);
230 	ctx->H[7] = UINT64_C (0x5be0cd19137e2179);
231 
232 	ctx->total[0] = ctx->total[1] = 0;
233 	ctx->buflen = 0;
234 }
235 
236 
237 /* Process the remaining bytes in the internal buffer and the usual
238 	prolog according to the standard and write the result to RESBUF.
239 
240 	IMPORTANT: On some systems it is required that RESBUF is correctly
241 	aligned for a 32 bits value. */
sha512_finish_ctx(struct sha512_ctx * ctx,void * resbuf)242 static void * sha512_finish_ctx (struct sha512_ctx *ctx, void *resbuf) {
243 	/* Take yet unprocessed bytes into account.  */
244 	uint64_t bytes = ctx->buflen;
245 	size_t pad;
246 	unsigned int i;
247 
248 	/* Now count remaining bytes.  */
249 	ctx->total[0] += bytes;
250 	if (ctx->total[0] < bytes) {
251 		++ctx->total[1];
252 	}
253 
254 	pad = bytes >= 112 ? 128 + 112 - (size_t)bytes : 112 - (size_t)bytes;
255 	memcpy(&ctx->buffer[bytes], fillbuf, pad);
256 
257 	/* Put the 128-bit file length in *bits* at the end of the buffer.  */
258 	*(uint64_t *) &ctx->buffer[bytes + pad + 8] = SWAP(ctx->total[0] << 3);
259 	*(uint64_t *) &ctx->buffer[bytes + pad] = SWAP((ctx->total[1] << 3) |
260 						(ctx->total[0] >> 61));
261 
262 	/* Process last bytes.  */
263 	sha512_process_block(ctx->buffer, (size_t)(bytes + pad + 16), ctx);
264 
265 	/* Put result from CTX in first 64 bytes following RESBUF.  */
266 	for (i = 0; i < 8; ++i) {
267 		((uint64_t *) resbuf)[i] = SWAP(ctx->H[i]);
268 	}
269 
270 	return resbuf;
271 }
272 
273 static void
sha512_process_bytes(const void * buffer,size_t len,struct sha512_ctx * ctx)274 sha512_process_bytes(const void *buffer, size_t len, struct sha512_ctx *ctx) {
275 	/* When we already have some bits in our internal buffer concatenate
276 	 both inputs first.  */
277 	if (ctx->buflen != 0) {
278 		size_t left_over = (size_t)ctx->buflen;
279 		size_t add = (size_t)(256 - left_over > len ? len : 256 - left_over);
280 
281 		memcpy(&ctx->buffer[left_over], buffer, add);
282 		ctx->buflen += add;
283 
284 		if (ctx->buflen > 128) {
285 			sha512_process_block(ctx->buffer, ctx->buflen & ~127, ctx);
286 
287 			ctx->buflen &= 127;
288 			/* The regions in the following copy operation cannot overlap.  */
289 			memcpy(ctx->buffer, &ctx->buffer[(left_over + add) & ~127],
290 					(size_t)ctx->buflen);
291 		}
292 
293 		buffer = (const char *) buffer + add;
294 		len -= add;
295 	}
296 
297 	/* Process available complete blocks.  */
298 	if (len >= 128) {
299 #if !_STRING_ARCH_unaligned
300 /* To check alignment gcc has an appropriate operator.  Other
301    compilers don't.  */
302 # if __GNUC__ >= 2
303 #  define UNALIGNED_P(p) (((uintptr_t) p) % __alignof__ (uint64_t) != 0)
304 # else
305 #  define UNALIGNED_P(p) (((uintptr_t) p) % sizeof(uint64_t) != 0)
306 # endif
307 		if (UNALIGNED_P(buffer))
308 			while (len > 128) {
309 				sha512_process_block(memcpy(ctx->buffer, buffer, 128), 128, ctx);
310 				buffer = (const char *) buffer + 128;
311 				len -= 128;
312 			}
313 		else
314 #endif
315 		{
316 		  sha512_process_block(buffer, len & ~127, ctx);
317 		  buffer = (const char *) buffer + (len & ~127);
318 		  len &= 127;
319 		}
320 	}
321 
322   /* Move remaining bytes into internal buffer.  */
323 	if (len > 0) {
324 		size_t left_over = (size_t)ctx->buflen;
325 
326 		memcpy(&ctx->buffer[left_over], buffer, len);
327 		left_over += len;
328 		if (left_over >= 128) {
329 			sha512_process_block(ctx->buffer, 128, ctx);
330 			left_over -= 128;
331 			memcpy(ctx->buffer, &ctx->buffer[128], left_over);
332 		}
333 		ctx->buflen = left_over;
334 	}
335 }
336 
337 
338 /* Define our magic string to mark salt for SHA512 "encryption"
339    replacement.  */
340 static const char sha512_salt_prefix[] = "$6$";
341 
342 /* Prefix for optional rounds specification.  */
343 static const char sha512_rounds_prefix[] = "rounds=";
344 
345 /* Maximum salt string length.  */
346 #define SALT_LEN_MAX 16
347 /* Default number of rounds if not explicitly specified.  */
348 #define ROUNDS_DEFAULT 5000
349 /* Minimum number of rounds.  */
350 #define ROUNDS_MIN 1000
351 /* Maximum number of rounds.  */
352 #define ROUNDS_MAX 999999999
353 
354 /* Table with characters for base64 transformation.  */
355 static const char b64t[64] =
356 "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
357 
358 
359 char *
php_sha512_crypt_r(const char * key,const char * salt,char * buffer,int buflen)360 php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen) {
361 #ifdef PHP_WIN32
362 	ZEND_SET_ALIGNED(64, unsigned char alt_result[64]);
363 	ZEND_SET_ALIGNED(64, unsigned char temp_result[64]);
364 #else
365 	ZEND_SET_ALIGNED(__alignof__ (uint64_t), unsigned char alt_result[64]);
366 	ZEND_SET_ALIGNED(__alignof__ (uint64_t), unsigned char temp_result[64]);
367 #endif
368 	struct sha512_ctx ctx;
369 	struct sha512_ctx alt_ctx;
370 	size_t salt_len;
371 	size_t key_len;
372 	size_t cnt;
373 	char *cp;
374 	char *copied_key = NULL;
375 	char *copied_salt = NULL;
376 	char *p_bytes;
377 	char *s_bytes;
378 	/* Default number of rounds.  */
379 	size_t rounds = ROUNDS_DEFAULT;
380 	zend_bool rounds_custom = 0;
381 
382 	/* Find beginning of salt string.  The prefix should normally always
383 	 be present.  Just in case it is not.  */
384 	if (strncmp(sha512_salt_prefix, salt, sizeof(sha512_salt_prefix) - 1) == 0) {
385 		/* Skip salt prefix.  */
386 		salt += sizeof(sha512_salt_prefix) - 1;
387 	}
388 
389 	if (strncmp(salt, sha512_rounds_prefix, sizeof(sha512_rounds_prefix) - 1) == 0) {
390 		const char *num = salt + sizeof(sha512_rounds_prefix) - 1;
391 		char *endp;
392 		zend_ulong srounds = ZEND_STRTOUL(num, &endp, 10);
393 
394 		if (*endp == '$') {
395 			salt = endp + 1;
396 			if (srounds < ROUNDS_MIN || srounds > ROUNDS_MAX) {
397 				return NULL;
398 			}
399 
400 			rounds = srounds;
401 			rounds_custom = 1;
402 		}
403 	}
404 
405 	salt_len = MIN(strcspn(salt, "$"), SALT_LEN_MAX);
406 	key_len = strlen(key);
407 
408 	if ((uintptr_t)key % __alignof__ (uint64_t) != 0) {
409 		char *tmp = (char *) alloca (key_len + __alignof__ (uint64_t));
410 		key = copied_key =
411 		memcpy(tmp + __alignof__(uint64_t) - (uintptr_t)tmp % __alignof__(uint64_t), key, key_len);
412 	}
413 
414 	if ((uintptr_t)salt % __alignof__ (uint64_t) != 0) {
415 		char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint64_t));
416 		salt = copied_salt = memcpy(tmp + __alignof__(uint64_t) - (uintptr_t)tmp % __alignof__(uint64_t), salt, salt_len);
417 		copied_salt[salt_len] = 0;
418 	}
419 
420 	/* Prepare for the real work.  */
421 	sha512_init_ctx(&ctx);
422 
423 	/* Add the key string.  */
424 	sha512_process_bytes(key, key_len, &ctx);
425 
426 	/* The last part is the salt string.  This must be at most 16
427 	 characters and it ends at the first `$' character (for
428 	 compatibility with existing implementations).  */
429 	sha512_process_bytes(salt, salt_len, &ctx);
430 
431 
432 	/* Compute alternate SHA512 sum with input KEY, SALT, and KEY.  The
433 	 final result will be added to the first context.  */
434 	sha512_init_ctx(&alt_ctx);
435 
436 	/* Add key.  */
437 	sha512_process_bytes(key, key_len, &alt_ctx);
438 
439 	/* Add salt.  */
440 	sha512_process_bytes(salt, salt_len, &alt_ctx);
441 
442 	/* Add key again.  */
443 	sha512_process_bytes(key, key_len, &alt_ctx);
444 
445 	/* Now get result of this (64 bytes) and add it to the other
446 	 context.  */
447 	sha512_finish_ctx(&alt_ctx, alt_result);
448 
449 	/* Add for any character in the key one byte of the alternate sum.  */
450 	for (cnt = key_len; cnt > 64; cnt -= 64) {
451 		sha512_process_bytes(alt_result, 64, &ctx);
452 	}
453 	sha512_process_bytes(alt_result, cnt, &ctx);
454 
455 	/* Take the binary representation of the length of the key and for every
456 	 1 add the alternate sum, for every 0 the key.  */
457 	for (cnt = key_len; cnt > 0; cnt >>= 1) {
458 		if ((cnt & 1) != 0) {
459 			sha512_process_bytes(alt_result, 64, &ctx);
460 		} else {
461 			sha512_process_bytes(key, key_len, &ctx);
462 		}
463 	}
464 
465 	/* Create intermediate result.  */
466 	sha512_finish_ctx(&ctx, alt_result);
467 
468 	/* Start computation of P byte sequence.  */
469 	sha512_init_ctx(&alt_ctx);
470 
471 	/* For every character in the password add the entire password.  */
472 	for (cnt = 0; cnt < key_len; ++cnt) {
473 		sha512_process_bytes(key, key_len, &alt_ctx);
474 	}
475 
476 	/* Finish the digest.  */
477 	sha512_finish_ctx(&alt_ctx, temp_result);
478 
479 	/* Create byte sequence P.  */
480 	cp = p_bytes = alloca(key_len);
481 	for (cnt = key_len; cnt >= 64; cnt -= 64) {
482 		cp = __php_mempcpy((void *) cp, (const void *)temp_result, 64);
483 	}
484 
485 	memcpy(cp, temp_result, cnt);
486 
487 	/* Start computation of S byte sequence.  */
488 	sha512_init_ctx(&alt_ctx);
489 
490 	/* For every character in the password add the entire password.  */
491 	for (cnt = 0; cnt < (size_t) (16 + alt_result[0]); ++cnt) {
492 		sha512_process_bytes(salt, salt_len, &alt_ctx);
493 	}
494 
495 	/* Finish the digest.  */
496 	sha512_finish_ctx(&alt_ctx, temp_result);
497 
498 	/* Create byte sequence S.  */
499 	cp = s_bytes = alloca(salt_len);
500 	for (cnt = salt_len; cnt >= 64; cnt -= 64) {
501 		cp = __php_mempcpy(cp, temp_result, 64);
502 	}
503 	memcpy(cp, temp_result, cnt);
504 
505 	/* Repeatedly run the collected hash value through SHA512 to burn
506 	 CPU cycles.  */
507 	for (cnt = 0; cnt < rounds; ++cnt) {
508 		/* New context.  */
509 		sha512_init_ctx(&ctx);
510 
511 		/* Add key or last result.  */
512 		if ((cnt & 1) != 0) {
513 			sha512_process_bytes(p_bytes, key_len, &ctx);
514 		} else {
515 			sha512_process_bytes(alt_result, 64, &ctx);
516 		}
517 
518 		/* Add salt for numbers not divisible by 3.  */
519 		if (cnt % 3 != 0) {
520 			sha512_process_bytes(s_bytes, salt_len, &ctx);
521 		}
522 
523 		/* Add key for numbers not divisible by 7.  */
524 		if (cnt % 7 != 0) {
525 			sha512_process_bytes(p_bytes, key_len, &ctx);
526 		}
527 
528 		/* Add key or last result.  */
529 		if ((cnt & 1) != 0) {
530 			sha512_process_bytes(alt_result, 64, &ctx);
531 		} else {
532 			sha512_process_bytes(p_bytes, key_len, &ctx);
533 		}
534 
535 		/* Create intermediate result.  */
536 		sha512_finish_ctx(&ctx, alt_result);
537 	}
538 
539 	/* Now we can construct the result string.  It consists of three
540 	 parts.  */
541 	cp = __php_stpncpy(buffer, sha512_salt_prefix, MAX(0, buflen));
542 	buflen -= sizeof(sha512_salt_prefix) - 1;
543 
544 	if (rounds_custom) {
545 #ifdef PHP_WIN32
546 	  int n = _snprintf(cp, MAX(0, buflen), "%s" ZEND_ULONG_FMT "$", sha512_rounds_prefix, rounds);
547 #else
548 	  int n = snprintf(cp, MAX(0, buflen), "%s%zu$", sha512_rounds_prefix, rounds);
549 #endif
550 	  cp += n;
551 	  buflen -= n;
552 	}
553 
554 	cp = __php_stpncpy(cp, salt, MIN((size_t) MAX(0, buflen), salt_len));
555 	buflen -= (int) MIN((size_t) MAX(0, buflen), salt_len);
556 
557 	if (buflen > 0) {
558 		*cp++ = '$';
559 		--buflen;
560 	}
561 
562 #define b64_from_24bit(B2, B1, B0, N)                    \
563   do {									                 \
564 	unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0);	 \
565 	int n = (N);							             \
566 	while (n-- > 0 && buflen > 0)					     \
567 	  {									                 \
568 	*cp++ = b64t[w & 0x3f];						         \
569 	--buflen;							                 \
570 	w >>= 6;							                 \
571 	  }									                 \
572   } while (0)
573 
574 	b64_from_24bit(alt_result[0], alt_result[21], alt_result[42], 4);
575 	b64_from_24bit(alt_result[22], alt_result[43], alt_result[1], 4);
576 	b64_from_24bit(alt_result[44], alt_result[2], alt_result[23], 4);
577 	b64_from_24bit(alt_result[3], alt_result[24], alt_result[45], 4);
578 	b64_from_24bit(alt_result[25], alt_result[46], alt_result[4], 4);
579 	b64_from_24bit(alt_result[47], alt_result[5], alt_result[26], 4);
580 	b64_from_24bit(alt_result[6], alt_result[27], alt_result[48], 4);
581 	b64_from_24bit(alt_result[28], alt_result[49], alt_result[7], 4);
582 	b64_from_24bit(alt_result[50], alt_result[8], alt_result[29], 4);
583 	b64_from_24bit(alt_result[9], alt_result[30], alt_result[51], 4);
584 	b64_from_24bit(alt_result[31], alt_result[52], alt_result[10], 4);
585 	b64_from_24bit(alt_result[53], alt_result[11], alt_result[32], 4);
586 	b64_from_24bit(alt_result[12], alt_result[33], alt_result[54], 4);
587 	b64_from_24bit(alt_result[34], alt_result[55], alt_result[13], 4);
588 	b64_from_24bit(alt_result[56], alt_result[14], alt_result[35], 4);
589 	b64_from_24bit(alt_result[15], alt_result[36], alt_result[57], 4);
590 	b64_from_24bit(alt_result[37], alt_result[58], alt_result[16], 4);
591 	b64_from_24bit(alt_result[59], alt_result[17], alt_result[38], 4);
592 	b64_from_24bit(alt_result[18], alt_result[39], alt_result[60], 4);
593 	b64_from_24bit(alt_result[40], alt_result[61], alt_result[19], 4);
594 	b64_from_24bit(alt_result[62], alt_result[20], alt_result[41], 4);
595 	b64_from_24bit(0, 0, alt_result[63], 2);
596 
597 	if (buflen <= 0) {
598 		errno = ERANGE;
599 		buffer = NULL;
600 	} else {
601 		*cp = '\0';		/* Terminate the string.  */
602 	}
603 
604 	/* Clear the buffer for the intermediate result so that people
605 	 attaching to processes or reading core dumps cannot get any
606 	 information.  We do it in this way to clear correct_words[]
607 	 inside the SHA512 implementation as well.  */
608 	sha512_init_ctx(&ctx);
609 	sha512_finish_ctx(&ctx, alt_result);
610 	ZEND_SECURE_ZERO(temp_result, sizeof(temp_result));
611 	ZEND_SECURE_ZERO(p_bytes, key_len);
612 	ZEND_SECURE_ZERO(s_bytes, salt_len);
613 	ZEND_SECURE_ZERO(&ctx, sizeof(ctx));
614 	ZEND_SECURE_ZERO(&alt_ctx, sizeof(alt_ctx));
615 	if (copied_key != NULL) {
616 		ZEND_SECURE_ZERO(copied_key, key_len);
617 	}
618 	if (copied_salt != NULL) {
619 		ZEND_SECURE_ZERO(copied_salt, salt_len);
620 	}
621 
622 	return buffer;
623 }
624 
625 
626 /* This entry point is equivalent to the `crypt' function in Unix
627    libcs.  */
628 char *
php_sha512_crypt(const char * key,const char * salt)629 php_sha512_crypt(const char *key, const char *salt) {
630 	/* We don't want to have an arbitrary limit in the size of the
631 	 password.  We can compute an upper bound for the size of the
632 	 result in advance and so we can prepare the buffer we pass to
633 	 `sha512_crypt_r'.  */
634 	ZEND_TLS char *buffer;
635 	ZEND_TLS int buflen = 0;
636 	int needed = (int)(sizeof(sha512_salt_prefix) - 1
637 		+ sizeof(sha512_rounds_prefix) + 9 + 1
638 		+ strlen(salt) + 1 + 86 + 1);
639 
640 	if (buflen < needed) {
641 		char *new_buffer = (char *) realloc(buffer, needed);
642 		if (new_buffer == NULL) {
643 			return NULL;
644 		}
645 
646 		buffer = new_buffer;
647 		buflen = needed;
648 	}
649 
650 	return php_sha512_crypt_r (key, salt, buffer, buflen);
651 }
652 
653 #ifdef TEST
654 static const struct {
655 	const char *input;
656 	const char result[64];
657 } tests[] =
658 	{
659 	/* Test vectors from FIPS 180-2: appendix C.1.  */
660 	{ "abc",
661 	  "\xdd\xaf\x35\xa1\x93\x61\x7a\xba\xcc\x41\x73\x49\xae\x20\x41\x31"
662 	  "\x12\xe6\xfa\x4e\x89\xa9\x7e\xa2\x0a\x9e\xee\xe6\x4b\x55\xd3\x9a"
663 	  "\x21\x92\x99\x2a\x27\x4f\xc1\xa8\x36\xba\x3c\x23\xa3\xfe\xeb\xbd"
664 	  "\x45\x4d\x44\x23\x64\x3c\xe8\x0e\x2a\x9a\xc9\x4f\xa5\x4c\xa4\x9f" },
665 	/* Test vectors from FIPS 180-2: appendix C.2.  */
666 	{ "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn"
667 	  "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu",
668 	  "\x8e\x95\x9b\x75\xda\xe3\x13\xda\x8c\xf4\xf7\x28\x14\xfc\x14\x3f"
669 	  "\x8f\x77\x79\xc6\xeb\x9f\x7f\xa1\x72\x99\xae\xad\xb6\x88\x90\x18"
670 	  "\x50\x1d\x28\x9e\x49\x00\xf7\xe4\x33\x1b\x99\xde\xc4\xb5\x43\x3a"
671 	  "\xc7\xd3\x29\xee\xb6\xdd\x26\x54\x5e\x96\xe5\x5b\x87\x4b\xe9\x09" },
672 	/* Test vectors from the NESSIE project.  */
673 	{ "",
674 	  "\xcf\x83\xe1\x35\x7e\xef\xb8\xbd\xf1\x54\x28\x50\xd6\x6d\x80\x07"
675 	  "\xd6\x20\xe4\x05\x0b\x57\x15\xdc\x83\xf4\xa9\x21\xd3\x6c\xe9\xce"
676 	  "\x47\xd0\xd1\x3c\x5d\x85\xf2\xb0\xff\x83\x18\xd2\x87\x7e\xec\x2f"
677 	  "\x63\xb9\x31\xbd\x47\x41\x7a\x81\xa5\x38\x32\x7a\xf9\x27\xda\x3e" },
678 	{ "a",
679 	  "\x1f\x40\xfc\x92\xda\x24\x16\x94\x75\x09\x79\xee\x6c\xf5\x82\xf2"
680 	  "\xd5\xd7\xd2\x8e\x18\x33\x5d\xe0\x5a\xbc\x54\xd0\x56\x0e\x0f\x53"
681 	  "\x02\x86\x0c\x65\x2b\xf0\x8d\x56\x02\x52\xaa\x5e\x74\x21\x05\x46"
682 	  "\xf3\x69\xfb\xbb\xce\x8c\x12\xcf\xc7\x95\x7b\x26\x52\xfe\x9a\x75" },
683 	{ "message digest",
684 	  "\x10\x7d\xbf\x38\x9d\x9e\x9f\x71\xa3\xa9\x5f\x6c\x05\x5b\x92\x51"
685 	  "\xbc\x52\x68\xc2\xbe\x16\xd6\xc1\x34\x92\xea\x45\xb0\x19\x9f\x33"
686 	  "\x09\xe1\x64\x55\xab\x1e\x96\x11\x8e\x8a\x90\x5d\x55\x97\xb7\x20"
687 	  "\x38\xdd\xb3\x72\xa8\x98\x26\x04\x6d\xe6\x66\x87\xbb\x42\x0e\x7c" },
688 	{ "abcdefghijklmnopqrstuvwxyz",
689 	  "\x4d\xbf\xf8\x6c\xc2\xca\x1b\xae\x1e\x16\x46\x8a\x05\xcb\x98\x81"
690 	  "\xc9\x7f\x17\x53\xbc\xe3\x61\x90\x34\x89\x8f\xaa\x1a\xab\xe4\x29"
691 	  "\x95\x5a\x1b\xf8\xec\x48\x3d\x74\x21\xfe\x3c\x16\x46\x61\x3a\x59"
692 	  "\xed\x54\x41\xfb\x0f\x32\x13\x89\xf7\x7f\x48\xa8\x79\xc7\xb1\xf1" },
693 	{ "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
694 	  "\x20\x4a\x8f\xc6\xdd\xa8\x2f\x0a\x0c\xed\x7b\xeb\x8e\x08\xa4\x16"
695 	  "\x57\xc1\x6e\xf4\x68\xb2\x28\xa8\x27\x9b\xe3\x31\xa7\x03\xc3\x35"
696 	  "\x96\xfd\x15\xc1\x3b\x1b\x07\xf9\xaa\x1d\x3b\xea\x57\x78\x9c\xa0"
697 	  "\x31\xad\x85\xc7\xa7\x1d\xd7\x03\x54\xec\x63\x12\x38\xca\x34\x45" },
698 	{ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
699 	  "\x1e\x07\xbe\x23\xc2\x6a\x86\xea\x37\xea\x81\x0c\x8e\xc7\x80\x93"
700 	  "\x52\x51\x5a\x97\x0e\x92\x53\xc2\x6f\x53\x6c\xfc\x7a\x99\x96\xc4"
701 	  "\x5c\x83\x70\x58\x3e\x0a\x78\xfa\x4a\x90\x04\x1d\x71\xa4\xce\xab"
702 	  "\x74\x23\xf1\x9c\x71\xb9\xd5\xa3\xe0\x12\x49\xf0\xbe\xbd\x58\x94" },
703 	{ "123456789012345678901234567890123456789012345678901234567890"
704 	  "12345678901234567890",
705 	  "\x72\xec\x1e\xf1\x12\x4a\x45\xb0\x47\xe8\xb7\xc7\x5a\x93\x21\x95"
706 	  "\x13\x5b\xb6\x1d\xe2\x4e\xc0\xd1\x91\x40\x42\x24\x6e\x0a\xec\x3a"
707 	  "\x23\x54\xe0\x93\xd7\x6f\x30\x48\xb4\x56\x76\x43\x46\x90\x0c\xb1"
708 	  "\x30\xd2\xa4\xfd\x5d\xd1\x6a\xbb\x5e\x30\xbc\xb8\x50\xde\xe8\x43" }
709   };
710 #define ntests (sizeof (tests) / sizeof (tests[0]))
711 
712 
713 static const struct
714 {
715 	const char *salt;
716 	const char *input;
717 	const char *expected;
718 } tests2[] = {
719 	{ "$6$saltstring", "Hello world!",
720 	"$6$saltstring$svn8UoSVapNtMuq1ukKS4tPQd8iKwSMHWjl/O817G3uBnIFNjnQJu"
721 	"esI68u4OTLiBFdcbYEdFCoEOfaS35inz1"},
722 	{ "$6$rounds=10000$saltstringsaltstring", "Hello world!",
723 	"$6$rounds=10000$saltstringsaltst$OW1/O6BYHV6BcXZu8QVeXbDWra3Oeqh0sb"
724 	"HbbMCVNSnCM/UrjmM0Dp8vOuZeHBy/YTBmSK6H9qs/y3RnOaw5v." },
725 	{ "$6$rounds=5000$toolongsaltstring", "This is just a test",
726 	"$6$rounds=5000$toolongsaltstrin$lQ8jolhgVRVhY4b5pZKaysCLi0QBxGoNeKQ"
727 	"zQ3glMhwllF7oGDZxUhx1yxdYcz/e1JSbq3y6JMxxl8audkUEm0" },
728 	{ "$6$rounds=1400$anotherlongsaltstring",
729 	"a very much longer text to encrypt.  This one even stretches over more"
730 	"than one line.",
731 	"$6$rounds=1400$anotherlongsalts$POfYwTEok97VWcjxIiSOjiykti.o/pQs.wP"
732 	"vMxQ6Fm7I6IoYN3CmLs66x9t0oSwbtEW7o7UmJEiDwGqd8p4ur1" },
733 	{ "$6$rounds=77777$short",
734 	"we have a short salt string but not a short password",
735 	"$6$rounds=77777$short$WuQyW2YR.hBNpjjRhpYD/ifIw05xdfeEyQoMxIXbkvr0g"
736 	"ge1a1x3yRULJ5CCaUeOxFmtlcGZelFl5CxtgfiAc0" },
737 	{ "$6$rounds=123456$asaltof16chars..", "a short string",
738 	"$6$rounds=123456$asaltof16chars..$BtCwjqMJGx5hrJhZywWvt0RLE8uZ4oPwc"
739 	"elCjmw2kSYu.Ec6ycULevoBK25fs2xXgMNrCzIMVcgEJAstJeonj1" },
740 	{ "$6$rounds=10$roundstoolow", "the minimum number is still observed",
741 	"$6$rounds=1000$roundstoolow$kUMsbe306n21p9R.FRkW3IGn.S9NPN0x50YhH1x"
742 	"hLsPuWGsUSklZt58jaTfF4ZEQpyUNGc0dqbpBYYBaHHrsX." },
743 };
744 #define ntests2 (sizeof (tests2) / sizeof (tests2[0]))
745 
746 
main(void)747 int main (void) {
748 	struct sha512_ctx ctx;
749 	char sum[64];
750 	int result = 0;
751 	int cnt;
752 	int i;
753 	char buf[1000];
754 	static const char expected[64] =
755 		"\xe7\x18\x48\x3d\x0c\xe7\x69\x64\x4e\x2e\x42\xc7\xbc\x15\xb4\x63"
756 		"\x8e\x1f\x98\xb1\x3b\x20\x44\x28\x56\x32\xa8\x03\xaf\xa9\x73\xeb"
757 		"\xde\x0f\xf2\x44\x87\x7e\xa6\x0a\x4c\xb0\x43\x2c\xe5\x77\xc3\x1b"
758 		"\xeb\x00\x9c\x5c\x2c\x49\xaa\x2e\x4e\xad\xb2\x17\xad\x8c\xc0\x9b";
759 
760 	for (cnt = 0; cnt < (int) ntests; ++cnt) {
761 		sha512_init_ctx (&ctx);
762 		sha512_process_bytes (tests[cnt].input, strlen (tests[cnt].input), &ctx);
763 		sha512_finish_ctx (&ctx, sum);
764 		if (memcmp (tests[cnt].result, sum, 64) != 0) {
765 			printf ("test %d run %d failed\n", cnt, 1);
766 			result = 1;
767 		}
768 
769 		sha512_init_ctx (&ctx);
770 		for (i = 0; tests[cnt].input[i] != '\0'; ++i) {
771 			sha512_process_bytes (&tests[cnt].input[i], 1, &ctx);
772 		}
773 		sha512_finish_ctx (&ctx, sum);
774 		if (memcmp (tests[cnt].result, sum, 64) != 0) {
775 			printf ("test %d run %d failed\n", cnt, 2);
776 			result = 1;
777 		}
778 	}
779 
780 	/* Test vector from FIPS 180-2: appendix C.3.  */
781 
782 	memset (buf, 'a', sizeof (buf));
783 	sha512_init_ctx (&ctx);
784 	for (i = 0; i < 1000; ++i) {
785 		sha512_process_bytes (buf, sizeof (buf), &ctx);
786 	}
787 
788 	sha512_finish_ctx (&ctx, sum);
789 	if (memcmp (expected, sum, 64) != 0) {
790 		printf ("test %d failed\n", cnt);
791 		result = 1;
792 	}
793 
794 	for (cnt = 0; cnt < ntests2; ++cnt) {
795 		char *cp = php_sha512_crypt(tests2[cnt].input, tests2[cnt].salt);
796 
797 		if (strcmp (cp, tests2[cnt].expected) != 0) {
798 			printf ("test %d: expected \"%s\", got \"%s\"\n",
799 					cnt, tests2[cnt].expected, cp);
800 			result = 1;
801 		}
802 	}
803 
804 	if (result == 0) {
805 		puts ("all tests OK");
806 	}
807 
808 	return result;
809 }
810 #endif
811