oss-security - One byte stack buffer overflow in keepassxc / zxcvbn-c

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20170304164823.3fb862c4@pc1>
Date: Sat, 4 Mar 2017 16:48:23 +0100
From: Hanno Böck <hanno@...eck.de>
To:
  "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: One byte stack buffer overflow in keepassxc / zxcvbn-c

Hi,

I recently reported a one byte buffer overflow in keepassxc [1] [2].
It's a pretty typical C bug: An array supposed to hold a string of a
certain size plus a trailing zero byte is one byte too small (i.e. the
size doesn't consider the trailing zero).
Given that the overflow happens right at the application's startup I
doubt it's exploitable in a meaningful way.
The bug was discovered simply by compiling with asan and running
keepassxc.

The code comes from zxcvbn-c (a checker for password quality), where
I've also reported it [3] (together with another minor bug regarding a
misuse of new [] / delete).

keepassxc is a fork of keepassx. However keepassx is not affected, as
it doesn't contain the zxcvbn password quality checking code.

One takeaway of this is that even amongst developers of security tools
the use of address sanitizer is still not a standard practice
everyone's using to test their C code.

[1] https://github.com/keepassxreboot/keepassxc/pull/363
[2] https://github.com/keepassxreboot/keepassxc/pull/365
[3] https://github.com/tsyrogit/zxcvbn-c/pull/11

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.