Date: Tue, 14 Aug 2012 23:04:16 +0200 From: magnum <john.magnum@...hmail.com> To: john-dev@...ts.openwall.com Subject: Serious wordlist.c bug fixed (all branches) This time I'm probably the bad guy, or one of them. The problem was this, as I understand it: 1. Wordlist.c optionally buffers words in an array of memory. 2. Some formats just copy the key _pointer_ in set_key(). 3. When wordlist is done, it free()'s the array. 4. Right before John exits, it emits the final status line. That line ends with the last candidate(s) tried. The first of these is fetched using get_key(), which now tries to read the free'd memory. Bang. The above is not very confusing and bug was easily fixed (that array is now allocated with mem_alloc_tiny() and is not freed in wordlist.c). What *is* confusing is that I never stumbled on it earlier, and no-one else reported it. As far as I can understand, this bug was introduced when we fixed wordlist buffering *long* ago. Maybe there are pretty few formats that just copy the pointer *and* still need it in get_key(). And maybe a format needed a max_keys_per_crypt >1 in order to trigger this. I found it when running Oracle 10. BTW, the Test Suite *should* have triggered this segfault, but did not. Very confusing. Maybe I'll do some forensics to understand the whole issue. magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.