Restore compatibility with 2.0.0's fix for wraparound bug (#81)

1 files changed, 8 insertions, 0 deletions

diff --git a/src/bcrypt/__init__.py b/src/bcrypt/__init__.py
index c2be96d..d6acb84 100644
--- a/src/bcrypt/__init__.py
+++ b/src/bcrypt/__init__.py
@@ -67,6 +67,14 @@ def hashpw(password, salt):
     if b"\x00" in password:
         raise ValueError("password may not contain NUL bytes")
 
+    # bcrypt originally suffered from a wraparound bug:
+    # http://www.openwall.com/lists/oss-security/2012/01/02/4
+    # This bug was corrected in the OpenBSD source by truncating inputs to 72
+    # bytes on the updated prefix $2b$, but leaving $2a$ unchanged for
+    # compatibility. However, pyca/bcrypt 2.0.0 *did* correctly truncate inputs
+    # on $2a$, so we do it here to preserve compatibility with 2.0.0
+    password = password[:72]
+
     salt = _normalize_prefix(salt)
 
     hashed = _bcrypt.ffi.new("unsigned char[]", 128)