And I trust you... why?

[Espen Harlinn]

Why not use CryptCreateHash[^] with CALG_SHA256 ?

Espen Harlinn Principal Architect, Software - Goodtech Projects & Services AS My LinkedIn Profile

[Ennis Ray Lynch Jr]

How much does this "oft-updated" library cost? : )

Need custom software developed? I do custom programming based primarily on MS tools with an emphasis on C# development and consulting. I also do Android Programming as I find it a refreshing break from the MS. "And they, since they Were not the one dead, turned to their affairs" -- Robert Frost

[Wjousts]

I think the point is that it took them well over a year to fix what seems like a pretty serious bug.

[Lost User]

Pretty serious bug? The first one may be a little serious, secretly corrupting the result like that.. but it's not very hard to notice and easy to work around. Seriously though, both of those bugs fall into the category of "will never happen anyway".

[OriginalGriff]

Depends when they were made aware it existed. If all their testing was on SSE2 x86 or above machines, it could have been a year before they were even told there was a problem.

Ideological Purity is no substitute for being able to stick your thumb down a pipe to stop the water

[Single Step Debugger]

If I recall correctly SHA-hash is a simple set of XOR operations. Better implement it yourself. Xoring buffers in C/C++ is a no brainer.

There is only one Vera Farmiga and Salma Hayek is her prophet! Advertise here – minimum three posts per day are guaranteed.

[peterchen]

Over 16 months of "generating invalid SHA's". Just imagining the dungstorm of a pool of wrong-SHA'd data accumulated over a year.

FILETIME to time_t
| FoldWithUs! | sighist | WhoIncludes - Analyzing C++ include file hierarchy

[Lost User]

It's slightly more complicated..

[Single Step Debugger]

It could be, what I’ve done was SHA-1, probably SHA256 is more complicated.

There is only one Vera Farmiga and Salma Hayek is her prophet! Advertise here – minimum three posts per day are guaranteed.

[unitrunker]

Why did you wait 14 months to tell them? :)

[Chris Losinger]

peterchen wrote:

non-SSE2 x86

aka Pentium 3 or earlier. http://en.wikipedia.org/wiki/SSE2[^]

image processing toolkits | batch image processing

[Lost User]

Now tell them that they're running late by almost 3 months to release version 5.6.2. :)

[Lost User]

Or an AMD K7, which is slightly more recent than the P3, but not much.

[peterchen]

Serious because acuumulating wrong SHA's over months or even a year is a ventilator-hitting-rear-exhaust-product waiting to happen. In addition, the "wrong" SHA's may be collision-prone or not even stable.

FILETIME to time_t
| FoldWithUs! | sighist | WhoIncludes - Analyzing C++ include file hierarchy

[peterchen]

But eyeballs! :cool:

FILETIME to time_t
| FoldWithUs! | sighist | WhoIncludes - Analyzing C++ include file hierarchy

[Lost User]

Sure... if you have an ancient CPU, which you don't. Or if your buffer crosses 0x80000000, which it won't.

[Lost User]

Only for x86... Maybe they weren't much of a concern.

Computers have been intelligent for a long time now. It just so happens that the program writers are about as effective as a room full of monkeys trying to crank out a copy of Hamlet.

[peterchen]

harold aptroot wrote:

if you have an ancient CPU,

If I know beforehand, I can block customers running on this. Otherwise, I don't have much control over that. My clients are "very conservative", to say the least.

harold aptroot wrote:

Or if your buffer crosses 0x80000000, which it won't.

If I know beforehand that I can't use /LARGEADDRESSAWARE, I can do that. Now, yes, the large address space bug is feckin' hard to detect (requires an experienced coder who knows the problem). However, the x86-non-SSE-codepath is pretty darn easy to test even on a system with SSE.

FILETIME to time_t
| FoldWithUs! | sighist | WhoIncludes - Analyzing C++ include file hierarchy

[CPallini]

Collin Jasnoch wrote:

Only for x86

:laugh:

Veni, vidi, vici.