Executive brief
Crypt::Argon2 is a Perl library used for securely hashing and verifying passwords. A flaw in the password verification function allows the system to crash or behave unpredictably if it attempts to verify an empty password hash, such as those found in empty database columns or placeholder records. This could lead to a denial-of-service condition where an application becomes unavailable.
Technical details
The vulnerability is caused by an integer underflow in the `argon2_verify` function within `Argon2.xs`. When an empty string is provided as the encoded hash input, the code performs `encoded_len - 1` without a bounds check, resulting in a `size_t` underflow to `SIZE_MAX`. This value is passed to `memchr`, causing it to scan adjacent heap memory for a '