{"action":"created","issue":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1552","labels_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1552/labels{/name}","comments_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1552/comments","events_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1552/events","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1552","id":94657849,"number":1552,"title":"sha1crypt_common_plug.c:51  Asan  heap-buffer-overflow","user":{"login":"loverszhaokai","id":2187242,"avatar_url":"https://avatars.githubusercontent.com/u/2187242?v=3","gravatar_id":"","url":"https://api.github.com/users/loverszhaokai","html_url":"https://github.com/loverszhaokai","followers_url":"https://api.github.com/users/loverszhaokai/followers","following_url":"https://api.github.com/users/loverszhaokai/following{/other_user}","gists_url":"https://api.github.com/users/loverszhaokai/gists{/gist_id}","starred_url":"https://api.github.com/users/loverszhaokai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/loverszhaokai/subscriptions","organizations_url":"https://api.github.com/users/loverszhaokai/orgs","repos_url":"https://api.github.com/users/loverszhaokai/repos","events_url":"https://api.github.com/users/loverszhaokai/events{/privacy}","received_events_url":"https://api.github.com/users/loverszhaokai/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/labels/bug","name":"bug","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-13T07:33:52Z","updated_at":"2015-07-13T16:33:31Z","closed_at":null,"body":"# 1. Reproduce\r\n\r\n$ cat pwfile\r\n```\r\n$sha1$94000$wnUR8T1U$vt1TFQ50tBMFgkflAFAOer2CwdYZ\r\n```\r\n$ ./configure --enable-asan && make -sj8\r\n$ ./john pwfile\r\n```\r\n=================================================================\r\n==17349==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000eff2 at pc 0x56713f bp 0x7ffe59d9e5a0 sp 0x7ffe59d9e598\r\nREAD of size 1 at 0x60600000eff2 thread T0\r\n    #0 0x56713e in base64_valid_length /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/base64_convert.c:1118\r\n    #1 0x8bc778 in sha1crypt_common_valid /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/sha1crypt_common_plug.c:51\r\n    #2 0x94f4ec in ldr_split_line /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:717\r\n    #3 0x94fe94 in ldr_load_pw_line /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:821\r\n    #4 0x94b503 in read_file /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:135\r\n    #5 0x951e4e in ldr_load_pw_file /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:1019\r\n    #6 0x94758c in john_load /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1023\r\n    #7 0x948ceb in john_init /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1307\r\n    #8 0x94a8b3 in main /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1748\r\n    #9 0x7fa5e0a38ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n    #10 0x406de8 (/home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/run/john+0x406de8)\r\n\r\n0x60600000eff2 is located 0 bytes to the right of 50-byte region [0x60600000efc0,0x60600000eff2)\r\nallocated by thread T0 here:\r\n    #0 0x7fa5e21f1937 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x32937)\r\n    #1 0x8bc432 in sha1crypt_common_valid /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/sha1crypt_common_plug.c:33\r\n    #2 0x94f4ec in ldr_split_line /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:717\r\n    #3 0x94fe94 in ldr_load_pw_line /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:821\r\n    #4 0x94b503 in read_file /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:135\r\n    #5 0x951e4e in ldr_load_pw_file /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:1019\r\n    #6 0x94758c in john_load /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1023\r\n    #7 0x948ceb in john_init /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1307\r\n    #8 0x94a8b3 in main /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1748\r\n    #9 0x7fa5e0a38ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/base64_convert.c:1118 base64_valid_length\r\nShadow bytes around the buggy address:\r\n  0x0c0c7fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0c7fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0c7fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0c7fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0c7fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n=>0x0c0c7fff9df0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00[02]fa\r\n  0x0c0c7fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0c7fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0c7fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0c7fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0c7fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07\r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Contiguous container OOB:fc\r\n  ASan internal:           fe\r\n==17349==ABORTING\r\nAborted (core dumped)\r\n```\r\n\r\n# 2. gdb Debug\r\n\r\n```C\r\nProgram received signal SIGABRT, Aborted.\r\n0x00007ffff5790cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56\r\n56\t../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.\r\n(gdb) bt\r\n#0  0x00007ffff5790cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56\r\n#1  0x00007ffff57940d8 in __GI_abort () at abort.c:89\r\n#2  0x00007ffff6f640e9 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#3  0x00007ffff6f5bde5 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#4  0x00007ffff6f5fbe2 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#5  0x00007ffff6f5b279 in __asan_report_error () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#6  0x00007ffff6f5c0c4 in __asan_report_load1 () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#7  0x000000000056713f in base64_valid_length (from=0x60600000eff2 \"\", from_t=e_b64_crypt, flags=0) at base64_convert.c:1118\r\n#8  0x00000000008bc779 in sha1crypt_common_valid (ciphertext=0x7ffffffce690 \"$sha1$94000$wnUR8T1U$vt1TFQ50tBMFgkflAFAOer2CwdYZ\", self=0xe66280 <fmt_cryptsha1>)\r\n    at sha1crypt_common_plug.c:51\r\n#9  0x000000000094f4ed in ldr_split_line (login=0x7ffffffce3f0, ciphertext=0x7ffffffce430, gecos=0x7ffffffce470, home=0x7ffffffce4b0, uid=0x7ffffffce4f0, source=0x0,\r\n    format=0x1225ee8 <database+104>, db_opts=0x63100038fe00, line=0x0) at loader.c:717\r\n#10 0x000000000094fe95 in ldr_load_pw_line (db=0x1225e80 <database>, line=0x7ffffffce690 \"$sha1$94000$wnUR8T1U$vt1TFQ50tBMFgkflAFAOer2CwdYZ\") at loader.c:821\r\n#11 0x000000000094b504 in read_file (db=0x1225e80 <database>, name=0x631000000868 \"err_pwfiles/pwfile.sha1crypt\", flags=2, process_line=0x94fd2d <ldr_load_pw_line>)\r\n    at loader.c:135\r\n#12 0x0000000000951e4f in ldr_load_pw_file (db=0x1225e80 <database>, name=0x631000000868 \"err_pwfiles/pwfile.sha1crypt\") at loader.c:1019\r\n#13 0x000000000094758d in john_load () at john.c:1023\r\n#14 0x0000000000948cec in john_init (name=0x7fffffffec2e \"john\", argc=2, argv=0x7fffffffe998) at john.c:1307\r\n#15 0x000000000094a8b4 in main (argc=2, argv=0x7fffffffe998) at john.c:1748\r\n(gdb)\r\n```"},"comment":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/comments/120987816","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1552#issuecomment-120987816","issue_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1552","id":120987816,"user":{"login":"jfoug","id":1270024,"avatar_url":"https://avatars.githubusercontent.com/u/1270024?v=3","gravatar_id":"","url":"https://api.github.com/users/jfoug","html_url":"https://github.com/jfoug","followers_url":"https://api.github.com/users/jfoug/followers","following_url":"https://api.github.com/users/jfoug/following{/other_user}","gists_url":"https://api.github.com/users/jfoug/gists{/gist_id}","starred_url":"https://api.github.com/users/jfoug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfoug/subscriptions","organizations_url":"https://api.github.com/users/jfoug/orgs","repos_url":"https://api.github.com/users/jfoug/repos","events_url":"https://api.github.com/users/jfoug/events{/privacy}","received_events_url":"https://api.github.com/users/jfoug/received_events","type":"User","site_admin":false},"created_at":"2015-07-13T16:33:31Z","updated_at":"2015-07-13T16:33:31Z","body":"Please retest this after 6c8cde9  I think it is fixed."}}