clojurewerkz/scrypt

JVM crash

BrunoBonacci opened this issue · 1 comments

When passing 0 as r or p values in encrypt the JVM crashes.

highcpu.core=> (sc/encrypt "secret" 16384 0 0)
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGFPE (0x8) at pc=0x000000010be20851, pid=7465, tid=52739
#
# JRE version: Java(TM) SE Runtime Environment (8.0_91-b14) (build 1.8.0_91-b14)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.91-b14 mixed mode bsd-amd64 compressed oops)
# Problematic frame:
# C  [scrypt7824392737349686412lib+0x851]  crypto_scrypt+0x91
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /Users/brunob/work/infra/highcpu/hs_err_pid7465.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

how to reproduce

(require '[clojurewerkz.scrypt.core :as sc])
;;=> nil
(sc/encrypt "secret" 16384 8 1)
;;=> "$s0$e0801$xtebVXyDttLIqgbByxzMuA==$LcMSiPHMo7ybHf5hE2MOq4kboc6KroRZr+fdfCRR2YE="

(sc/encrypt "secret" 16384 0 1)
;;=> CRASH
(sc/encrypt "secret" 16384 8 0)
;;=> CRASH

A better check over the input parameters should be performed.

Or the VM (or the Scrypt Java library) should not segfault. Feel free to submit a PR that adds argument sanity checking but I don't think it's an issue with this library that has no native code.