Date: Tue, 15 Nov 2011 23:52:34 +0400 From: Solar Designer <solar@...nwall.com> To: dillon@...llo.backplane.com, Nolan Lum <nol888@...il.com>, Colin Percival <cperciva@...ebsd.org>, deraadt@...nbsd.org, Todd Miller <Todd.Miller@...rtesan.com> Cc: oss-security@...ts.openwall.com Subject: Re: weird crypt-sha* in DragonFly BSD On Tue, Nov 15, 2011 at 06:35:02AM +0400, Solar Designer wrote: > There's also minor weirdness in the code - such as two local pointer > variables being declared static seemingly for no reason, and only > "final" but not "ctx" being zeroized in the end. But even this lack of > proper cleanup is very minor compared to the lack of stretching. It turns out that these other minor issues were inherited from phk's md5crypt.c from FreeBSD. Currently in FreeBSD, crypt-md5.c: crypt_md5() has extra static declarations (not only the output buffer, but also three pointers), and it forgets to zeroize ctx and ctx1 (even though it does zeroize final). md5crypt.c: __md5crypt() in NetBSD no longer has the extra statics, but it does forget to zeroize ctx and ctx1. md5crypt.c: md5crypt() in OpenBSD has the weird static pointers and forgets to zeroize ctx and ctx1. Not a big deal, but worth fixing, I think. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.