[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160706162703.GA4751@openwall.com>
Date: Wed, 6 Jul 2016 19:27:03 +0300
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: rules.c bug/feature
On Wed, Jul 06, 2016 at 05:27:33PM +0200, magnum wrote:
> While playing with some old contest rules I found a bug in John that's
> not Jumbo-specific: Apparently it lacks some checks so a 'ddd' rule will
> blow the destination buffer even at moderate input lengths (eg. 50).
No, this shouldn't be the case. It is assumed that any rule command may
double the word's length, and there's a safeguard inbetween commands.
The buffers are:
char buffer[3][RULE_WORD_SIZE * 2 + CACHE_BANK_SHIFT];
and the safeguard is:
in[RULE_WORD_SIZE - 1] = 0;
Is this somehow broken? We should identify the issue and fix it if so.
> I think the best fix is to quietly truncate the copy so ddd (and even
> dddd and so on) will work fine with short enough words? Here is a fix
> that seem to work but not much tested and I really did not count the
> fence posts very carefully:
I think we shouldn't include per-command workarounds like this. The
global safeguard above should be sufficient.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
