Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Jul 2016 19:27:03 +0300
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: rules.c bug/feature

On Wed, Jul 06, 2016 at 05:27:33PM +0200, magnum wrote:
> While playing with some old contest rules I found a bug in John that's 
> not Jumbo-specific: Apparently it lacks some checks so a 'ddd' rule will 
> blow the destination buffer even at moderate input lengths (eg. 50).

No, this shouldn't be the case.  It is assumed that any rule command may
double the word's length, and there's a safeguard inbetween commands.

The buffers are:

	char buffer[3][RULE_WORD_SIZE * 2 + CACHE_BANK_SHIFT];

and the safeguard is:

		in[RULE_WORD_SIZE - 1] = 0;

Is this somehow broken?  We should identify the issue and fix it if so.

> I think the best fix is to quietly truncate the copy so ddd (and even 
> dddd and so on) will work fine with short enough words? Here is a fix 
> that seem to work but not much tested and I really did not count the 
> fence posts very carefully:

I think we shouldn't include per-command workarounds like this.  The
global safeguard above should be sufficient.

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ