Date: Wed, 17 Jan 2007 21:42:23 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: New NT patch Alain, I wrote: > More importantly, the code in NT_fmt.c is buggy - the get_hash_*() and > binary_hash_*() functions are not supposed to return values that are out > of range for the corresponding hash table sizes. I am immediately > getting a segfault when I run this on an actual password file. I'm not > sure why the self-test passes; I might need to find that out and enhance > the self-test. Yes, the self-test is missing a range check on these. I'll fix that (added to my to-do list for JtR). With this bug fixed, the patch works. There's one other minor bug that I ran into, though - your set_key() and get_key() don't save the actual key, they only save a pointer. This results in erroneous status line output when a session is aborted or completed - and I'm not sure whether the reported cracked passwords will always be correct (although it appears that they are). The rest of JtR was programmed under the assumption that the caller is free to change the contents of memory where the key passed into set_key() resided before a subsequent call to get_key(). -- Alexander Peslyak <solar at openwall.com> GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15 http://www.openwall.com - bringing security into open computing environments -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ