From cba28c39ad63920c05241f59ce7e1ad6b47039df Mon Sep 17 00:00:00 2001
From: Joas Schilling <nickvergessen@gmx.de>
Date: Fri, 27 Sep 2013 01:18:28 +0200
Subject: [PATCH 1/3] [ticket/11873] Do not hash very large passwords in order
 to safe resources.

PHPBB3-11873
---
 phpBB/includes/functions.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index b2b12c1445..eef4ade4e7 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -502,6 +502,13 @@ function phpbb_hash($password)
 */
 function phpbb_check_hash($password, $hash)
 {
+	if (strlen($password) > 4096)
+	{
+		// If the password is too huge, we will simply reject it
+		// and not let the server try to hash it.
+		return false;
+	}
+
 	$itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
 	if (strlen($hash) == 34)
 	{

From c6aefcf555b51e7bcf00332290c9d94beddec02c Mon Sep 17 00:00:00 2001
From: Joas Schilling <nickvergessen@gmx.de>
Date: Fri, 27 Sep 2013 01:19:55 +0200
Subject: [PATCH 2/3] [ticket/11873] Add unit test for large password input.

The password should be rejected quite fast.

PHPBB3-11873
---
 tests/security/hash_test.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/security/hash_test.php b/tests/security/hash_test.php
index 0c2580c19b..e226365ef3 100644
--- a/tests/security/hash_test.php
+++ b/tests/security/hash_test.php
@@ -17,5 +17,13 @@ class phpbb_security_hash_test extends phpbb_test_case
 		$this->assertTrue(phpbb_check_hash('test', '$P$9isfrtKXWqrz8PvztXlL3.daw4U0zI1'));
 		$this->assertFalse(phpbb_check_hash('foo', '$H$9isfrtKXWqrz8PvztXlL3.daw4U0zI1'));
 	}
+
+	public function test_check_hash_with_large_input()
+	{
+		// 16 MB password, should be rejected quite fast
+		$start_time = time();
+		$this->assertFalse(phpbb_check_hash(str_repeat('a', 1024 * 1024 * 16), '$H$9isfrtKXWqrz8PvztXlL3.daw4U0zI1'));
+		$this->assertLessThanOrEqual(5, time() - $start_time);
+	}
 }
 

From 446ea9928d8373cf7695d3adda6d5ee30d5f94b4 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Sat, 28 Sep 2013 03:20:51 +0200
Subject: [PATCH 3/3] [prep-release-3.0.12] Update changelog for 3.0.12
 release.

---
 phpBB/docs/CHANGELOG.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/phpBB/docs/CHANGELOG.html b/phpBB/docs/CHANGELOG.html
index 6d8b39d524..71795f83ac 100644
--- a/phpBB/docs/CHANGELOG.html
+++ b/phpBB/docs/CHANGELOG.html
@@ -218,6 +218,7 @@
 <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-11368">PHPBB3-11368</a>] - Latest pm reports row count</li>
 <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-11583">PHPBB3-11583</a>] - InnoDB supports FULLTEXT index since MySQL 5.6.4.</li>
 <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-11740">PHPBB3-11740</a>] - Update link in FAQ to Ideas Centre</li>
+<li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-11873">PHPBB3-11873</a>] - Prevent expensive hash computation in phpbb_check_hash() by rejecting very long passwords</li>
 </ul>
 <h4>Sub-task</h4>
 <ul>