Comment on Security vulnerability in MySQL ubuntuparentComments−Negitivefrags14yThat wasn't how I read it.It sounds like they were casting the result of a memcmp to a char. A char only has a range of -128 to 127. The resulting overflow means that an arbitrary password hash has a 1/255 chance of landing on 0, but you still have to try a bunch to hit one.−mike-cardwell14yThis is incorrect. You do not need to try a different password each time.−tedunangst14yThe password is combined with a random value on each attempt, the hash will change each time.
Comments
That wasn't how I read it.
It sounds like they were casting the result of a memcmp to a char. A char only has a range of -128 to 127. The resulting overflow means that an arbitrary password hash has a 1/255 chance of landing on 0, but you still have to try a bunch to hit one.
This is incorrect. You do not need to try a different password each time.
The password is combined with a random value on each attempt, the hash will change each time.