-MFH:

 - #45430, windows implementation of crypt is not TS
 - add Blowfish (using implementation from Solar Designer <solar at openwal dot com>) and extended DES support
 - Make crypt features portable:
   - if no crypt_r, php's implemetation is used (all algo and TS), php can't be used with unsafe crypt anymore
   - if one algo is missing, php's implemetation is used
   - Windows always use php's implementation
 - removed old code in windows/

Author: pierrejoye

NEWS

@@ -161,6 +161,13 @@ PHP                                                                        NEWS
     perform class declaration (early and/or run-time binding) in exactly
     the same order as vanilla PHP. (Dmitry)
 
+- Improved crypt() function (Pierre)
+  . add Blowfish (using implementation from Solar Designer <solar at openwal dot com>) and extended DES support
+  . Make crypt features portable:
+    . if no crypt_r, php's implemetation is used (all algo and TS), php can't be used with unsafe crypt anymore
+    . if one algo is missing, php's implemetation is used
+    . Windows always use php's implementation
+
 - Added new date/time functionality: (Derick)
   . date_parse_from_format(): Parse date/time strings according to a format.
   . date_create_from_format()/DateTime::createFromFormat(): Create a date/time
@@ -202,7 +209,7 @@ PHP                                                                        NEWS
   . DatePeriod class which supports iterating over a DateTime object applying
     DateInterval on each iteration, up to an end date or limited by maximum
     number of occurences.
-
+- Added Extended DES, Blowfish to all
 - Added hash_copy() function. (Tony)
 - Added sha224 hash algorithm to the hash extension. (Scott)
 - Added ReflectionProperty::setAccessible() method that allows non-public
@@ -246,6 +253,8 @@ PHP                                                                        NEWS
   prop of wrapped object). (robin_fernandes at uk dot ibm dot com, Arnaud)
 - Fixed bug #45571 (ReflectionClass::export() shows superclasses' private
   static methods). (robin_fernandes at uk dot ibm dot com)
+- Fixed bug #45430 (windows implementation of crypt is not thread safe).
+  (Pierre)
 - Fixed bug #45345 (SPLFileInfo::getPathInfo() returning dir info instead of
   file info). (Etienne)
 - Fixed bug #45179 (--with-mysql-sock fails to compile & work). (Andrey)

ext/standard/config.m4

@@ -84,12 +84,6 @@ main() {
 ],[
   ac_cv_crypt_des=yes
 ])])
-if test "$ac_cv_crypt_des" = "yes"; then
-  ac_result=1
-else
-  ac_result=0
-fi
-AC_DEFINE_UNQUOTED(PHP_STD_DES_CRYPT, $ac_result, [Whether the system supports standard DES salt])
 
 AC_CACHE_CHECK(for extended DES crypt, ac_cv_crypt_ext_des,[
   AC_TRY_RUN([
@@ -114,12 +108,6 @@ main() {
 ],[
   ac_cv_crypt_ext_des=no
 ])])
-if test "$ac_cv_crypt_ext_des" = "yes"; then
-  ac_result=1
-else
-  ac_result=0
-fi
-AC_DEFINE_UNQUOTED(PHP_EXT_DES_CRYPT, $ac_result, [Whether the system supports extended DES salt])
 
 AC_CACHE_CHECK(for MD5 crypt, ac_cv_crypt_md5,[
 AC_TRY_RUN([
@@ -153,15 +141,6 @@ main() {
 ],[
   ac_cv_crypt_md5=no
 ])])
-if test "$ac_cv_crypt_md5" = "yes"; then
-  ac_result=1
-else
-  if test "$ac_cv_crypt_des" != "yes"; then
-    PHP_DEBUG_MACRO(debug.log)
-  fi
-  ac_result=0
-fi
-AC_DEFINE_UNQUOTED(PHP_MD5_CRYPT, $ac_result, [Whether the system supports MD5 salt])
 
 AC_CACHE_CHECK(for Blowfish crypt, ac_cv_crypt_blowfish,[
 AC_TRY_RUN([
@@ -192,12 +171,48 @@ main() {
 ],[
   ac_cv_crypt_blowfish=no
 ])])
-if test "$ac_cv_crypt_blowfish" = "yes"; then
-  ac_result=1
+
+dnl
+dnl If one of them is missing, use our own implementation, portable code is then possible
+dnl
+if test "$ac_cv_crypt_blowfish" = "no" || test "$ac_cv_crypt_des" = "no" || test "$ac_cv_crypt_ext_des" = "no" || test "x$php_crypt_r" = "x0"; then
+  AC_DEFINE_UNQUOTED(PHP_USE_PHP_CRYPT_R, 1, [Whether PHP has to use its own crypt_r for blowfish, des, ext des and md5])
+  AC_DEFINE_UNQUOTED(PHP_STD_DES_CRYPT, 1, [Whether the system supports standard DES salt])
+  AC_DEFINE_UNQUOTED(PHP_BLOWFISH_CRYPT, 1, [Whether the system supports BlowFish salt])
+  AC_DEFINE_UNQUOTED(PHP_EXT_DES_CRYPT, 1, [Whether the system supports extended DES salt])
+  AC_DEFINE_UNQUOTED(PHP_MD5_CRYPT, 1, [Whether the system supports extended DES salt])
+
+  PHP_ADD_SOURCES(PHP_EXT_DIR(standard), crypt_freesec.c crypt_blowfish.c php_crypt_r.c)
 else
-  ac_result=0
+  if test "$ac_cv_crypt_des" = "yes"; then
+    ac_result=1
+    ac_crypt_des=1
+  else
+    ac_result=0
+    ac_crypt_des=0
+  fi
+  AC_DEFINE_UNQUOTED(PHP_STD_DES_CRYPT, $ac_result, [Whether the system supports standard DES salt])
+
+  if test "$ac_cv_crypt_blowfish" = "yes"; then
+    ac_result=1
+    ac_crypt_blowfish=1
+  else
+    ac_result=0
+    ac_crypt_blowfish=0
+  fi
+  AC_DEFINE_UNQUOTED(PHP_BLOWFISH_CRYPT, $ac_result, [Whether the system supports BlowFish salt])
+
+  if test "$ac_cv_crypt_ext_des" = "yes"; then
+    ac_result=1
+    ac_crypt_edes=1
+  else
+    ac_result=0
+    ac_crypt_edes=0
+  fi
+  AC_DEFINE_UNQUOTED(PHP_EXT_DES_CRYPT, $ac_result, [Whether the system supports extended DES salt])
+
+  AC_DEFINE_UNQUOTED(PHP_USE_PHP_CRYPT_R, 0, [Whether PHP has to use its own crypt_r for blowfish, des and ext des])
 fi
-AC_DEFINE_UNQUOTED(PHP_BLOWFISH_CRYPT, $ac_result, [Whether the system supports BlowFish salt])
 
 dnl
 dnl Check for available functions

ext/standard/config.w32

@@ -7,10 +7,14 @@ AC_DEFINE("PHP_CONFIG_FILE_SCAN_DIR", PHP_CONFIG_FILE_SCAN_DIR);
 AC_DEFINE("HAVE_INET_PTON", 1);
 AC_DEFINE("HAVE_INET_NTOP", 1);
 
+AC_DEFINE("PHP_USE_PHP_CRYPT_R", 1);
+
 CHECK_HEADER_ADD_INCLUDE("timelib_config.h", "CFLAGS_STANDARD", "ext/date/lib");
 
 EXTENSION("standard", "array.c base64.c basic_functions.c browscap.c \
-	crc32.c crypt.c cyr_convert.c datetime.c dir.c dl.c dns.c exec.c \
+	crc32.c crypt.c \
+	crypt_freesec.c crypt_blowfish.c php_crypt_r.c \
+	cyr_convert.c datetime.c dir.c dl.c dns.c exec.c \
 	file.c filestat.c formatted_print.c fsock.c head.c html.c image.c \
 	info.c iptc.c lcg.c link.c mail.c math.c md5.c metaphone.c microtime.c \
 	pack.c pageinfo.c quot_print.c rand.c soundex.c \
@@ -23,4 +27,4 @@ EXTENSION("standard", "array.c base64.c basic_functions.c browscap.c \
 
 if (PHP_MBREGEX != "no") {
    CHECK_HEADER_ADD_INCLUDE("oniguruma.h", "CFLAGS_STANDARD", PHP_MBREGEX + ";ext\\mbstring\\oniguruma")   
-}
+}

ext/standard/crypt.c

@@ -23,17 +23,21 @@
 #include <stdlib.h>
 
 #include "php.h"
-
 #if HAVE_CRYPT
 
 #if HAVE_UNISTD_H
 #include <unistd.h>
 #endif
-#if HAVE_CRYPT_H
-#if defined(CRYPT_R_GNU_SOURCE) && !defined(_GNU_SOURCE)
-#define _GNU_SOURCE
-#endif
-#include <crypt.h>
+#ifdef PHP_USE_PHP_CRYPT_R
+# include "php_crypt_r.h"
+# include "crypt_freesec.h"
+#else
+# if HAVE_CRYPT_H
+#  if defined(CRYPT_R_GNU_SOURCE) && !defined(_GNU_SOURCE)
+#   define _GNU_SOURCE
+#  endif
+#  include <crypt.h>
+# endif
 #endif
 #if TM_IN_SYS_TIME
 #include <sys/time.h>
@@ -48,7 +52,6 @@
 
 #ifdef PHP_WIN32
 #include <process.h>
-extern char *crypt(char *__key, char *__salt);
 #endif
 
 #include "php_lcg.h"
@@ -98,8 +101,21 @@ PHP_MINIT_FUNCTION(crypt) /* {{{ */
 	REGISTER_LONG_CONSTANT("CRYPT_MD5", PHP_MD5_CRYPT, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("CRYPT_BLOWFISH", PHP_BLOWFISH_CRYPT, CONST_CS | CONST_PERSISTENT);
 
+#ifdef PHP_USE_PHP_CRYPT_R
+	php_init_crypt_r();
+#endif
+
+	return SUCCESS;
+}
+
+#ifdef PHP_USE_PHP_CRYPT_R
+PHP_MSHUTDOWN_FUNCTION(crypt)
+{
+	php_shutdown_crypt_r();
+
 	return SUCCESS;
 }
+#endif
 /* }}} */
 
 static unsigned char itoa64[] = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
@@ -135,7 +151,7 @@ PHP_FUNCTION(crypt)
 		memcpy(salt, salt_in, MIN(PHP_MAX_SALT_LEN, salt_in_len));
 	}
 
-	/* The automatic salt generation only covers standard DES and md5-crypt */
+	/* The automatic salt generation covers standard DES, md5-crypt and Blowfish (simple) */
 	if (!*salt) {
 #if PHP_MD5_CRYPT
 		strcpy(salt, "$1$");
@@ -147,21 +163,54 @@ PHP_FUNCTION(crypt)
 		salt[2] = '\0';
 #endif
 	}
-#if defined(HAVE_CRYPT_R) && (defined(_REENTRANT) || defined(_THREAD_SAFE))
+
+/* Windows (win32/crypt) has a stripped down version of libxcrypt and 
+	a CryptoApi md5_crypt implementation */
+#if PHP_USE_PHP_CRYPT_R
 	{
-#if defined(CRYPT_R_STRUCT_CRYPT_DATA)
+		struct php_crypt_extended_data buffer;
+
+		if (salt[0]=='$' && salt[1]=='1' && salt[2]=='$') {
+			char output[MD5_HASH_MAX_LEN];
+
+			RETURN_STRING(php_md5_crypt_r(str, salt, output), 1);
+		} else  if (
+				salt[0] == '$' &&
+				salt[1] == '2' &&
+				salt[2] == 'a' &&
+				salt[3] == '$' &&
+				salt[4] >= '0' && salt[4] <= '3' &&
+				salt[5] >= '0' && salt[5] <= '9' &&
+				salt[6] == '$') {
+			char output[PHP_MAX_SALT_LEN + 1];
+
+			memset(output, 0, PHP_MAX_SALT_LEN + 1);
+			php_crypt_blowfish_rn(str, salt, output, sizeof(output));
+
+			RETVAL_STRING(output, 1);
+			memset(output, 0, PHP_MAX_SALT_LEN + 1);
+		} else {
+			memset(&buffer, 0, sizeof(buffer));
+			_crypt_extended_init_r();
+			RETURN_STRING(_crypt_extended_r(str, salt, &buffer), 1);
+		}
+	}
+#else
+
+# if defined(HAVE_CRYPT_R) && (defined(_REENTRANT) || defined(_THREAD_SAFE))
+	{
+#  if defined(CRYPT_R_STRUCT_CRYPT_DATA)
 		struct crypt_data buffer;
 		memset(&buffer, 0, sizeof(buffer));
-#elif defined(CRYPT_R_CRYPTD)
+#  elif defined(CRYPT_R_CRYPTD)
 		CRYPTD buffer;
-#else
-#error Data struct used by crypt_r() is unknown. Please report.
-#endif
+#  else
+#    error Data struct used by crypt_r() is unknown. Please report.
+#  endif
 
 		RETURN_STRING(crypt_r(str, salt, &buffer), 1);
 	}
-#else
-	RETURN_STRING(crypt(str, salt), 1);
+# endif
 #endif
 }
 /* }}} */