pgcrypto 0.4.2

Started by Marko Kreenover 24 years ago2 messagesgeneral
Jump to latest
#1Marko Kreen
markokr@gmail.com

Hello again,

pgcrypto 0.4 had a nasty obscure bug, when after including
postgres.h the BYTE_ORDER is not defined, it compiles code for
both big-endian and little-endian machines. This makes MD5 and
SHA1 algorithms in internal library produce garbage, ofcourse
now HMAC and crypt-md5 produce junk too. Also Rijndael on
big-endian machine may be broken. If you used any external
library, you are fine.

Affected platforms: FreeBSD *, probably more.
Not affected: Linux/glibc 2.2, NetBSD 1.5.

http://www.l-t.ee/marko/pgsql/pgcrypto-0.4.2.tar.gz

Morale: _do_ run regression tests before real use...

--
marko

#2Oliver Jones
oliver@deeper.co.nz
In reply to: Marko Kreen (#1)
Re: [ANNOUNCE] pgcrypto 0.4.2

You know although you've announced pgcrypto a couple of times you've
never actually acurately described what the package does. Obviously it
has something to do with Crypto but what exactly? Is it a transport
layer? New datatypes? A storage layer or just "helper" functions for
encrypt varchar()/blob field entries.

Regards

Marko Kreen wrote:

Hello again,

pgcrypto 0.4 had a nasty obscure bug, when after including
postgres.h the BYTE_ORDER is not defined, it compiles code for
both big-endian and little-endian machines. This makes MD5 and
SHA1 algorithms in internal library produce garbage, ofcourse
now HMAC and crypt-md5 produce junk too. Also Rijndael on
big-endian machine may be broken. If you used any external
library, you are fine.

Affected platforms: FreeBSD *, probably more.
Not affected: Linux/glibc 2.2, NetBSD 1.5.

http://www.l-t.ee/marko/pgsql/pgcrypto-0.4.2.tar.gz

Morale: _do_ run regression tests before real use...

--
Oliver Jones - oliver@deeper.co.nz - Mobile: +64-21-41-2238
- Deeper Design Limited - http://www.deeperdesign.com