[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 15 Jul 2012 22:32:18 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: My audit of cracker, format, loader.c
On 2012-07-15 21:27, jfoug@....net wrote:
> ---- magnum <john.magnum@...hmail.com> wrote:
>> On 2012-07-15 18:43, Frank Dittrich wrote:
>>> On 07/15/2012 06:27 PM, jfoug wrote:
>>>> Format.c:
>>>>
>>>> - force un-aligned input to salt removed, but this may have
>>>> been by design.
>>>
>>> May be we should keep that for debug versions? But probably most
>>> people debug on architectures which allow unaligned access.
>>
>> I was actually planning that, for later, using #ifdef JOHN_DEBUG or
>> something (maybe just DEBUG?). I just took it out completely until
>> all new core stuff is merged (there are more to come). It's just a
>> couple of lines of extra logic.
>
> That logic (and numerous other things), should be put into core.
Maybe, but the 10 or so developers that submit formats each year
produces 250x the number of bugs Solar do (to be fair he is a lot less
productive though), and I believe he tests his code a lot better than
most of us.
The things I now removed was:
- intentionally misalign cipertexts, so we do not "miss" formats that
just happen to be aligned in a certain build. My intention was to get
less problems with the (infrequent) Sparc testing. This could probably
be re-implemented and extended to a couple more places later, especially
now that we know the aligment requirement for each format.
- put 8 byte canaries after binary and salt copies, and verify they do
not get overwritten. This I will not put back - the test, as it was
implemented, was totally flawed. But the idea could possibly be used
somewhere else.
> Another is the LM prepare from bleeding, should be put into core.
This is already true: LM_fmt.c in bleeding is now 100% pristine core code.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
