Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 16 Jul 2016 19:59:54 +0300
From: Solar Designer <>
Subject: Re: passwdqc code quality

On Sat, Jul 16, 2016 at 06:47:15PM +0200, Daniel Cegie??ka wrote:
> btw. I suspect that this error with memset

What "error with memset"?  Do you mean the potential removal of memset()
calls that we use for zeroization?  That's unrelated to the bug reported
via Debian that prompted me to look into passwdqc code quality again.

No, LTO had nothing to do with the bug reported via Debian.  There was
no memset() to remove in the first place.  And if there were, it
wouldn't be a valid optimization for the compiler to remove it, so a
bug-free compiler would not.

Maybe you haven't read this thread closely enough.

> fuzzers like Michal's AFL:

While AFL is great, I don't see how you'd use it to detect either bug
(the missed pw_dir initialization or the removal of memset() calls used
for zeroization).  If you can detect things like this with AFL, please
share how you do it.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.