Thread: pgcrypto 0.4.2

pgcrypto 0.4.2

From
Marko Kreen
Date:
Hello again,

pgcrypto 0.4 had a nasty obscure bug, when after including
postgres.h the BYTE_ORDER is not defined, it compiles code for
both big-endian and little-endian machines.  This makes MD5 and
SHA1 algorithms in internal library produce garbage, ofcourse
now HMAC and crypt-md5 produce junk too.  Also Rijndael on
big-endian machine may be broken.  If you used any external
library, you are fine.

Affected platforms: FreeBSD *, probably more.
Not affected: Linux/glibc 2.2, NetBSD 1.5.

    http://www.l-t.ee/marko/pgsql/pgcrypto-0.4.2.tar.gz

Morale: _do_ run regression tests before real use...

--
marko


Re: [ANNOUNCE] pgcrypto 0.4.2

From
Oliver Jones
Date:
You know although you've announced pgcrypto a couple of times you've
never actually acurately described what the package does.  Obviously it
has something to do with Crypto but what exactly?  Is it a transport
layer?  New datatypes?  A storage layer or just "helper" functions for
encrypt varchar()/blob field entries.

Regards

Marko Kreen wrote:

>Hello again,
>
>pgcrypto 0.4 had a nasty obscure bug, when after including
>postgres.h the BYTE_ORDER is not defined, it compiles code for
>both big-endian and little-endian machines.  This makes MD5 and
>SHA1 algorithms in internal library produce garbage, ofcourse
>now HMAC and crypt-md5 produce junk too.  Also Rijndael on
>big-endian machine may be broken.  If you used any external
>library, you are fine.
>
>Affected platforms: FreeBSD *, probably more.
>Not affected: Linux/glibc 2.2, NetBSD 1.5.
>
>    http://www.l-t.ee/marko/pgsql/pgcrypto-0.4.2.tar.gz
>
>Morale: _do_ run regression tests before real use...
>

--
Oliver Jones - oliver@deeper.co.nz - Mobile: +64-21-41-2238
- Deeper Design Limited - http://www.deeperdesign.com