Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <9a3ebacf90d01628e9e176fa69afc4ef@smtp.hushmail.com>
Date: Wed, 10 Apr 2013 01:44:07 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Core John warnings (was: new warnings with gcc 4.8.0)

On 24 Mar, 2013, at 9:45 , Dhiru Kholia <dhiru.kholia@...il.com> wrote:
> I tried to build unstable-jumbo with gcc 4.8.0 and got some new
> warnings.
> 
> Can we fix them before Jumbo8 release?

The Dynamic bug was real and is fixed. The remaining problems exist in core:


> DES_std.c: In function ‘DES_std_set_key’:
> DES_std.c:631:17: warning: array subscript is above array bounds [-Warray-bounds]
>    while (DES_key[i++]) k += 2;
>                  ^

In core John this is line 630:17. If I bump the definition by 2 (1 is not enough), the warning go away. But that is obviously not likely a real fix:

-static char DES_key[16];
+static char DES_key[16+2];


> inc.c: In function ‘do_incremental_crack’:
> inc.c:352:12: warning: array subscript is above array bounds [-Warray-bounds]
>     [numbers[pos]];
>             ^
> inc.c:352:12: warning: array subscript is above array bounds [-Warray-bounds]
> inc.c:405:16: warning: array subscript is above array bounds [-Warray-bounds]
>    if (++numbers[pos] <= count) goto update_all;
>                 ^
> inc.c:405:16: warning: array subscript is above array bounds [-Warray-bounds]
> inc.c:405:16: warning: array subscript is above array bounds [-Warray-bounds]
> inc.c:405:16: warning: array subscript is above array bounds [-Warray-bounds]
> inc.c:406:10: warning: array subscript is above array bounds [-Warray-bounds]
>    numbers[pos] = 0;

In core John these are at lines 301, 353 and 354. Again, if I bump the declaration by no less than 10(!), the warnings go away:

-static int numbers[CHARSET_LENGTH];
+static int numbers[CHARSET_LENGTH + 10];


I don't quite understand the code but these look like real bugs to me and if so, the inc.c one is worrisome. Solar, what do you say?

magnum

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.