Comments (4)
I've addressed your first issue in a portable manner. The second one is trickier, since people do not seem to agree on what a bounded sprintf
looks like. VS 2015 supports the standard C99 snprintf
, but previous versions of VS do not, where _snprintf
has different behavior (no null character guaranteed at the end).
Since there is no risk of overflow here, I would probably suggest using the _CRT_SECURE_NO_WARNINGS
macro to get around this particular warning.
from phc-winner-argon2.
Does that macro have to be applied globally, or can it be applied per source file? I'm of the mind set that if only a small piece of code throws a security warning, you don't disable that warning for the whole project if it could potentially come up elsewhere in later code changes.
I would agree, in this context, the buffers in question are well contained in code that is not externally or user accessible so the risk is low.
from phc-winner-argon2.
I will also add, in encoding.c and run.c, there are warnings thrown when compiling as x64 instead of Win32, that storing a size_t
in a uint32_t
or unsigned int
could cause possible loss of data.
These are in the definitions of CC_opt
and BIN
, and in run.c it's only for the line pwdlen = strlen(pwd);
which I don't think is an issue in that last case, as most people are going to use passwords less than a few hundred characters (or a key file of less than 1kb).
from phc-winner-argon2.
Macro only needs to be applied locally; e.g., put #define _CRT_SECURE_NO_WARNINGS
before any includes in src/encoding.c
.
I've fixed the warning in src/run.c
. The similar warnings in src/encoding.c
are inside macros, and the code becomes confusing and difficult to reason about if I just cast to uint32_t
. I'll think about a proper fix.
from phc-winner-argon2.
Related Issues (20)
- [Question] Use argon2 as a stream cipher
- Any plans to make new release? HOT 1
- test.c compilation
- Usage - Passing password in command line call HOT 3
- Unsure of how to use libargon2 HOT 1
- Same salt, pass? HOT 3
- Invalid Hash generated on Raspberry Pi 4 with latest 64 bit Linux deb 11 HOT 5
- Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits HOT 1
- Maximum password length: "Provided password longer than supported in command line utility" HOT 1
- What is the status of keyid & associated data fields ? HOT 2
- Function to get the encoded length before encoding HOT 1
- ASN.1 module HOT 2
- obtain salt from something else than a command argument HOT 2
- The argon2 command's default should be -id—not -i. HOT 1
- Add DLL file version information
- [email protected]
- Why is the blake2b algorithm selected? HOT 1
- does the lib in the readme has been checked before beeing added ?
- Unused last_node field, possibly old leftover code HOT 1
- Parameters "Secret" and "Associated data" are missing from a bunch of places
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from phc-winner-argon2.