Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 Jan 2007 21:42:23 +0300
From: Solar Designer <>
Subject: Re: New NT patch


I wrote:
> More importantly, the code in NT_fmt.c is buggy - the get_hash_*() and
> binary_hash_*() functions are not supposed to return values that are out
> of range for the corresponding hash table sizes.  I am immediately
> getting a segfault when I run this on an actual password file.  I'm not
> sure why the self-test passes; I might need to find that out and enhance
> the self-test.

Yes, the self-test is missing a range check on these.  I'll fix that
(added to my to-do list for JtR).

With this bug fixed, the patch works.  There's one other minor bug that
I ran into, though - your set_key() and get_key() don't save the actual
key, they only save a pointer.  This results in erroneous status line
output when a session is aborted or completed - and I'm not sure whether
the reported cracked passwords will always be correct (although it
appears that they are).  The rest of JtR was programmed under the
assumption that the caller is free to change the contents of memory
where the key passed into set_key() resided before a subsequent call to

Alexander Peslyak <solar at>
GPG key ID: 5B341F15  fp: B3FB 63F4 D7A3 BCCC 6F6E  FC55 A2FC 027C 5B34 1F15 - bringing security into open computing environments

To unsubscribe, e-mail and reply
to the automated confirmation request that will be sent to you.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.