diff -urpN uns2/src/DMD5_fmt_plug.c uns1/src/DMD5_fmt_plug.c --- uns2/src/DMD5_fmt_plug.c 2013-04-24 14:10:46.160824200 -0500 +++ uns1/src/DMD5_fmt_plug.c 2013-04-24 14:09:41.000000000 -0500 @@ -99,10 +99,6 @@ static struct { static ARCH_WORD_32 (*crypt_key)[BINARY_SIZE/4]; static char (*saved_key)[PLAINTEXT_LENGTH + 1]; -#ifdef _MSC_VER -#define snprintf sprintf_s -#endif - static struct fmt_tests tests[] = { {"$DIGEST-MD5$s3443$pjwstk$00$ldap/10.253.34.43$0734d94ad9abd5bd7fc5e7e77bcf49a8$00000001$auth-int$dd98347e6da3efd6c4ff2263a729ef77", "test"}, {NULL} diff -urpN uns2/src/dynamic_fmt.c uns1/src/dynamic_fmt.c --- uns2/src/dynamic_fmt.c 2013-04-24 14:10:46.516395300 -0500 +++ uns1/src/dynamic_fmt.c 2013-04-24 14:09:41.000000000 -0500 @@ -681,6 +681,12 @@ static int valid(char *ciphertext, struc return 0; else if (pPriv->dynamic_FIXED_SALT_SIZE < -1 && strlen(&cp[23]) > -(pPriv->dynamic_FIXED_SALT_SIZE)) return 0; + if ((pPriv->pSetup->startFlags & MGF_PHPassSetup) == MGF_PHPassSetup) { + // we have to perform the salt 'length' check here, so we do not process invalid hashes later. + int Lcount = atoi64[ARCH_INDEX(cp[23])]; + if (Lcount < 7 || Lcount > 31) + return 0; + } return 1; } if (pPriv->dynamic_base64_inout == 2) @@ -733,8 +739,11 @@ static int valid(char *ciphertext, struc if (atoi16[ARCH_INDEX(cp[i])] == 0x7f) return 0; } - if (!cp[cipherTextLen] && (pPriv->pSetup->flags&MGF_SALTED) == 0) - return 1; + if ((pPriv->pSetup->flags&MGF_SALTED) == 0) { + if (!cp[cipherTextLen]) + return 1; + return 0; + } if (cp[cipherTextLen] && cp[cipherTextLen] != '$') return 0; @@ -888,7 +897,6 @@ static void init(struct fmt_main *pFmt) *********************************************************************************/ static char *prepare(char *split_fields[10], struct fmt_main *pFmt) { - static char ct[512]; private_subformat_data *pPriv = pFmt->private.data; char Tmp[80]; int i; @@ -898,6 +906,11 @@ static char *prepare(char *split_fields[ if (!pPriv) return split_fields[1]; + // ANY field[1] longer than 490 will simply be ignored, and returned 'as is'. + // the rest of this function makes this assumption. + if (!cpBuilding || strlen(cpBuilding) > 490) + return cpBuilding; + if (pFmt->params.salt_size && !strchr(split_fields[1], '$')) { if (!pPriv->nUserName && !pPriv->FldMask) return split_fields[1]; @@ -908,16 +921,21 @@ static char *prepare(char *split_fields[ // $dynamic_x$ will be written out (into .pot, output lines, etc). if (!strncmp(cpBuilding, "md5_gen(", 8)) { + static char ct[496]; char *cp = &cpBuilding[8], *cpo = &ct[sprintf(ct, "$dynamic_")]; while (*cp >= '0' && *cp <= '9') *cpo++ = *cp++; *cpo++ = '$'; ++cp; - strnzcpy(cpo, cp, 512); + strcpy(cpo, cp); cpBuilding = ct; } + // At this point, max length of cpBuilding is 491 (if it was a md5_gen signature) cpBuilding = FixupIfNeeded(cpBuilding, pPriv); + + // at this point max length is still < 512. 491 + strlen($dynamic_xxxxx$) is 506 + if (strncmp(cpBuilding, "$dynamic_", 9)) return split_fields[1]; @@ -931,6 +949,7 @@ static char *prepare(char *split_fields[ if (strstr(cpBuilding, "$HEX$")) { char *cp, *cpo; int bGood=1; + static char ct[512]; strcpy(ct, cpBuilding); cp = strstr(ct, "$HEX$"); @@ -961,23 +980,34 @@ static char *prepare(char *split_fields[ } if (bGood) cpBuilding = ct; + // if we came into $HEX$ removal, then cpBuilding will always be shorter } + // at this point max length is still < 512. 491 + strlen($dynamic_xxxxx$) is 506 + if (pPriv->nUserName && !strstr(cpBuilding, "$$U")) { char *userName=split_fields[0], *cp; + static char ct[1024]; // assume field[0] is in format: username OR DOMAIN\\username If we find a \\, then use the username 'following' it. cp = strchr(split_fields[0], '\\'); if (cp) userName = &cp[1]; userName = HandleCase(userName, pPriv->nUserName); - sprintf (ct, "%s$$U%s", cpBuilding, userName); + snprintf (ct, sizeof(ct), "%s$$U%s", cpBuilding, userName); cpBuilding = ct; } - for (i = 0; i <= 8; ++i) { - sprintf(Tmp, "$$F%d", i); - if ( split_fields[i] && (pPriv->FldMask&(MGF_FLDx_BIT<FldMask) { + for (i = 0; i < 10; ++i) { + if (pPriv->FldMask&(MGF_FLDx_BIT< 950) + return ciphertext; + if (!strncmp(ciphertext, "$dynamic", 8)) { if (strstr(ciphertext, "$HEX$")) return RemoveHEX(out, ciphertext); @@ -1010,7 +1043,7 @@ static char *split(char *ciphertext, int char *cp = out + sprintf(out, "%s", pPriv->dynamic_WHICH_TYPE_SIG); RemoveHEX(cp, ciphertext); } else - sprintf(out, "%s%s", pPriv->dynamic_WHICH_TYPE_SIG, ciphertext); + snprintf(out, sizeof(out), "%s%s", pPriv->dynamic_WHICH_TYPE_SIG, ciphertext); return out; } diff -urpN uns2/src/HDAA_fmt_plug.c uns1/src/HDAA_fmt_plug.c --- uns2/src/HDAA_fmt_plug.c 2013-04-24 14:10:46.179327900 -0500 +++ uns1/src/HDAA_fmt_plug.c 2013-04-24 14:09:41.000000000 -0500 @@ -11,10 +11,6 @@ #include -#ifdef _MSC_VER -#define snprintf _snprintf -#endif - #ifdef __MMX__ #include #endif diff -urpN uns2/src/mediawiki_fmt_plug.c uns1/src/mediawiki_fmt_plug.c --- uns2/src/mediawiki_fmt_plug.c 2013-04-24 14:10:46.742940600 -0500 +++ uns1/src/mediawiki_fmt_plug.c 2013-04-24 14:09:42.000000000 -0500 @@ -90,6 +90,8 @@ static char *Convert(char *Buf, char *ci if (text_in_dynamic_format_already(pDynamic_9, ciphertext)) return ciphertext; + if (strncmp(ciphertext, "$B$", 3)) + return ciphertext; cp = strchr(&ciphertext[3], '$'); if (!cp) return "*"; diff -urpN uns2/src/misc.h uns1/src/misc.h --- uns2/src/misc.h 2013-04-24 14:10:46.755943200 -0500 +++ uns1/src/misc.h 2013-04-24 14:09:42.000000000 -0500 @@ -123,7 +123,9 @@ extern char *strupr(char *s); #define strcasecmp _stricmp #define alloca _alloca #pragma warning (disable : 4018 297 ) +#undef inline #define inline _inline +#define snprintf sprintf_s #endif #endif diff -urpN uns2/src/postgres_fmt_plug.c uns1/src/postgres_fmt_plug.c --- uns2/src/postgres_fmt_plug.c 2013-04-24 14:10:47.383568700 -0500 +++ uns1/src/postgres_fmt_plug.c 2013-04-24 14:09:42.000000000 -0500 @@ -29,10 +29,6 @@ static int omp_t = 1; #include "params.h" #include "options.h" -#ifdef _MSC_VER -#define snprintf _snprintf -#endif - #define FORMAT_LABEL "postgres" #define FORMAT_NAME "PostgreSQL MD5 challenge-response" #define ALGORITHM_NAME "32/" ARCH_BITS_STR diff -urpN uns2/src/sip_fmt_plug.c uns1/src/sip_fmt_plug.c --- uns2/src/sip_fmt_plug.c 2013-04-24 14:10:47.529597900 -0500 +++ uns1/src/sip_fmt_plug.c 2013-04-24 14:09:42.000000000 -0500 @@ -25,10 +25,6 @@ static int omp_t = 1; #define OMP_SCALE 1 #endif -#ifdef _MSC_VER -#define snprintf _snprintf -#endif - typedef struct sip_salt_t { int static_hash_data_len, dynamic_hash_data_len; char *static_hash_data, *dynamic_hash_data;