Comment by bawolff

That's interesting, but i don't see how this can actually be leveraged into a vulnerability.

But gosh, between this and the sha with null truncating bcrypt bug, php has had bad luck implementing password routines.