[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20070117184223.GA24141@openwall.com>
Date: Wed, 17 Jan 2007 21:42:23 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: New NT patch
Alain,
I wrote:
> More importantly, the code in NT_fmt.c is buggy - the get_hash_*() and
> binary_hash_*() functions are not supposed to return values that are out
> of range for the corresponding hash table sizes. I am immediately
> getting a segfault when I run this on an actual password file. I'm not
> sure why the self-test passes; I might need to find that out and enhance
> the self-test.
Yes, the self-test is missing a range check on these. I'll fix that
(added to my to-do list for JtR).
With this bug fixed, the patch works. There's one other minor bug that
I ran into, though - your set_key() and get_key() don't save the actual
key, they only save a pointer. This results in erroneous status line
output when a session is aborted or completed - and I'm not sure whether
the reported cracked passwords will always be correct (although it
appears that they are). The rest of JtR was programmed under the
assumption that the caller is free to change the contents of memory
where the key passed into set_key() resided before a subsequent call to
get_key().
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
