[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <020701ccbb7a$535b0520$fa110f60$@net>
Date: Thu, 15 Dec 2011 16:38:54 -0600
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: RE: External mode (lack of) truncation
The formats themselves should NOT have to worry about length of a password, nor should they ever waste time checking lengths passed in. This should be an assertion. If the format lists max length at 15, then it should never be given anything longer.
Thus, this is an issue. I make no checks at all in dynamic, and I am 100% sure, this will cause non-critical buffer overflows, and cause candidates to be smashed. If a large enough word is passed in, then it will overwrite critical areas and crash.
>From: magnum
>I just noticed external.c does not truncate at format's max length. I
>thought it did, because I believe all other modes do. Some formats (like
>nt2) die from, for example, --ext:repeats because of this and I am
>guilty of some (or all) of them doing so :-/
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
