[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <3486e383577e9e4b16828725cb931093@smtp.hushmail.com>
Date: Tue, 14 Aug 2012 23:04:16 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Serious wordlist.c bug fixed (all branches)
This time I'm probably the bad guy, or one of them. The problem was
this, as I understand it:
1. Wordlist.c optionally buffers words in an array of memory.
2. Some formats just copy the key _pointer_ in set_key().
3. When wordlist is done, it free()'s the array.
4. Right before John exits, it emits the final status line. That line
ends with the last candidate(s) tried. The first of these is fetched
using get_key(), which now tries to read the free'd memory. Bang.
The above is not very confusing and bug was easily fixed (that array is
now allocated with mem_alloc_tiny() and is not freed in wordlist.c).
What *is* confusing is that I never stumbled on it earlier, and no-one
else reported it. As far as I can understand, this bug was introduced
when we fixed wordlist buffering *long* ago. Maybe there are pretty few
formats that just copy the pointer *and* still need it in get_key(). And
maybe a format needed a max_keys_per_crypt >1 in order to trigger this.
I found it when running Oracle 10.
BTW, the Test Suite *should* have triggered this segfault, but did not.
Very confusing. Maybe I'll do some forensics to understand the whole issue.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
