john-users - Re: New NT patch

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 17 Jan 2007 21:42:23 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: New NT patch

Alain,

I wrote:
> More importantly, the code in NT_fmt.c is buggy - the get_hash_*() and
> binary_hash_*() functions are not supposed to return values that are out
> of range for the corresponding hash table sizes.  I am immediately
> getting a segfault when I run this on an actual password file.  I'm not
> sure why the self-test passes; I might need to find that out and enhance
> the self-test.

Yes, the self-test is missing a range check on these.  I'll fix that
(added to my to-do list for JtR).

With this bug fixed, the patch works.  There's one other minor bug that
I ran into, though - your set_key() and get_key() don't save the actual
key, they only save a pointer.  This results in erroneous status line
output when a session is aborted or completed - and I'm not sure whether
the reported cracked passwords will always be correct (although it
appears that they are).  The rest of JtR was programmed under the
assumption that the caller is free to change the contents of memory
where the key passed into set_key() resided before a subsequent call to
get_key().

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15  fp: B3FB 63F4 D7A3 BCCC 6F6E  FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.