Date: Sat, 4 Mar 2017 16:48:23 +0100 From: Hanno Böck <hanno@...eck.de> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: One byte stack buffer overflow in keepassxc / zxcvbn-c Hi, I recently reported a one byte buffer overflow in keepassxc  . It's a pretty typical C bug: An array supposed to hold a string of a certain size plus a trailing zero byte is one byte too small (i.e. the size doesn't consider the trailing zero). Given that the overflow happens right at the application's startup I doubt it's exploitable in a meaningful way. The bug was discovered simply by compiling with asan and running keepassxc. The code comes from zxcvbn-c (a checker for password quality), where I've also reported it  (together with another minor bug regarding a misuse of new  / delete). keepassxc is a fork of keepassx. However keepassx is not affected, as it doesn't contain the zxcvbn password quality checking code. One takeaway of this is that even amongst developers of security tools the use of address sanitizer is still not a standard practice everyone's using to test their C code.  https://github.com/keepassxreboot/keepassxc/pull/363  https://github.com/keepassxreboot/keepassxc/pull/365  https://github.com/tsyrogit/zxcvbn-c/pull/11 -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ