9a77171ccc
Algorithmic complexity attacks against hash tables have been known since 2003 (cf. [1, 2]), and they have been left unpatched for years until the 2011 attacks [3] against many libraries / (reference) implementations of programming languages. This patch adds a qHash overload taking two arguments: the value to be hashed, and a uint to be used as a seed for the hash function itself (support the global QHash seed was added in a previous patch). The seed itself is not used just yet; instead, 0 is passed. Compatibility with the one-argument qHash(T) implementation is kept through a catch-all template. [1] http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf [2] http://perldoc.perl.org/perlsec.html#Algorithmic-Complexity-Attacks [3] http://www.ocert.org/advisories/ocert-2011-003.html Task-number: QTBUG-23529 Change-Id: I1d0a84899476d134db455418c8043a349a7e5317 Reviewed-by: João Abecasis <joao.abecasis@nokia.com> |
||
---|---|---|
bin | ||
config.tests | ||
dist | ||
doc/src | ||
examples | ||
lib | ||
mkspecs | ||
qmake | ||
src | ||
tests | ||
tools | ||
util | ||
.gitattributes | ||
.gitignore | ||
.tag | ||
configure | ||
configure.bat | ||
header.BSD | ||
header.FDL | ||
header.LGPL | ||
header.LGPL-ONLY | ||
INSTALL | ||
LGPL_EXCEPTION.txt | ||
LICENSE.FDL | ||
LICENSE.LGPL | ||
LICENSE.PREVIEW.COMMERCIAL | ||
qtbase.pro | ||
sync.profile |