php/php-src — pull request #868 by lt (2014-10-06 12:47:38+00:00)
Title: Support crypt_blowfish revision 'b'

Targets 5.5, 5.6 and master. I think this is more of a feature than a security fix, so probably not necessary to target 5.4

The issue: [http://www.openwall.com/lists/oss-security/2012/01/02/4](OpenBSD bcrypt 8-bit key_len wraparound)

PHP does not assign the key length to an 8 bit type, instead limiting the length using a loop of 18 * 4 (72) when performing the key expansion. Therefore I believe PHP is able to safely generate and validate the `$2b$` bcrypt revision.

I would appreciate a review of this assumption. (/cc @ircmaxell)

Thanks.