Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANO7a6y-xJp73riMSf3vs=baUgYj5gLGgtxJ46Z4sMKuSgOjNw@mail.gmail.com>
Date: Fri, 22 Jun 2012 19:36:03 +0530
From: Dhiru Kholia <dhiru.kholia@...il.com>
To: john-dev@...ts.openwall.com
Subject: bug or false alarm in BSDI format with clang

Hi,

I compile JtR using "make linux-x86-64-clang-debug. Running
"../run/john  -format=BSDI -t" crashed with following output.

Benchmarking: BSDI DES (x725) [128/128 BS SSE2-16]...
=================================================================
==4865== ERROR: AddressSanitizer global-buffer-overflow on address
0x00000069e041 at pc 0x416d93 bp 0x7fff50725a30 sp 0x7fff50725a28
READ of size 1 at 0x00000069e041 thread T0
    #0 0x416d93 (/home/dsk/magnum-jumbo/run/john+0x416d93)
0x00000069e041 is located 0 bytes to the right of global variable
'.str12 (formats.c)' (0x69e040) of size 1
  '.str12 (formats.c)' is ascii string ''
==4865== ABORTING
Stats: 0M malloced (0M for red zones) by 28 calls
Stats: 0M realloced by 0 calls
Stats: 0M freed by 5 calls
Stats: 0M really freed by 0 calls
Stats: 20M (5123 full pages) mmaped in 5 calls
  mmaps   by size class: 8:16383; 10:4095; 12:1024; 13:512; 17:32;
  mallocs by size class: 8:11; 10:5; 12:2; 13:1; 17:9;
  frees   by size class: 10:5;
  rfrees  by size class:
Stats: malloc large: 9 small slow: 4
Shadow byte and word:
  0x1000000d3c08: 1
  0x1000000d3c08: 01 f9 f9 f9 f9 f9 f9 f9
More shadow bytes:
  0x1000000d3be8: 00 04 f9 f9 f9 f9 f9 f9
  0x1000000d3bf0: 00 04 f9 f9 f9 f9 f9 f9
  0x1000000d3bf8: 00 06 f9 f9 f9 f9 f9 f9
  0x1000000d3c00: 00 04 f9 f9 f9 f9 f9 f9
=>0x1000000d3c08: 01 f9 f9 f9 f9 f9 f9 f9
  0x1000000d3c10: 04 f9 f9 f9 f9 f9 f9 f9
  0x1000000d3c18: 05 f9 f9 f9 f9 f9 f9 f9
  0x1000000d3c20: 04 f9 f9 f9 f9 f9 f9 f9
  0x1000000d3c28: 00 00 00 00 00 00 00 00

...

On further debugging,

$ addr2line -a 0x00000069e041 -e a.out
0x000000000069e041
sse-intrinsics.c:0


$ addr2line -a 0x416d93  -e ../run/john
0x0000000000416d93
/home/dsk/magnum-jumbo/src/DES_std.c:659

>> DES_key[1] = key[1] & 0x7F;

Can someone familiar with the format take a look? Testing DES itself
which uses the same code (guessing?) passes with no problems.

-- 
Cheers,
Dhiru

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.