[#SEC-754] Wrong byte array lenght used in Md4PasswordEncoder#encodePassword

Spring Security

Wrong byte array lenght used in Md4PasswordEncoder#encodePassword

Created: 07/Apr/08 06:09 AM Updated: 07/Apr/08 10:03 AM

Component/s:

Core

Affects Version/s:

2.0.0 RC1

Fix Version/s:

2.0.0

Time Tracking:

Original Estimate:

0.02d

Remaining Estimate:

0.02d

Time Spent:

Not Specified

Description

« Hide

Part of patch for bug #~~SEC-728~~ has been incorrectly applied.

The line
md4.update(passBytes, 0, saltedPass.length());
should read
md4.update(passBytes, 0, passBytes.length());

The current (2.0RC1) version is incorrect, since the number of chars in an UTF-8 string is generally NOT equal to it number of bytes!

All

Comments

Work Log

Change History

FishEye

Builds

Sort Order:

[ Permlink | « Hide ]

Luke Taylor added a comment - 07/Apr/08 10:03 AM

I've made the correction and added some tests with chinese passwords.