{"action":"created","issue":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1554","labels_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1554/labels{/name}","comments_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1554/comments","events_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1554/events","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1554","id":94737965,"number":1554,"title":"dynamic_fmt.c:2003  Asan  unknown-crash","user":{"login":"loverszhaokai","id":2187242,"avatar_url":"https://avatars.githubusercontent.com/u/2187242?v=3","gravatar_id":"","url":"https://api.github.com/users/loverszhaokai","html_url":"https://github.com/loverszhaokai","followers_url":"https://api.github.com/users/loverszhaokai/followers","following_url":"https://api.github.com/users/loverszhaokai/following{/other_user}","gists_url":"https://api.github.com/users/loverszhaokai/gists{/gist_id}","starred_url":"https://api.github.com/users/loverszhaokai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/loverszhaokai/subscriptions","organizations_url":"https://api.github.com/users/loverszhaokai/orgs","repos_url":"https://api.github.com/users/loverszhaokai/repos","events_url":"https://api.github.com/users/loverszhaokai/events{/privacy}","received_events_url":"https://api.github.com/users/loverszhaokai/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/labels/bug","name":"bug","color":"e11d21"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-13T14:45:37Z","updated_at":"2015-07-13T15:44:09Z","closed_at":"2015-07-13T15:43:40Z","body":"# 1. Reproduce\r\n\r\n## pwfile\r\n```\r\nThe pwfile is too large to display here. It is already minized. \r\nHere is the link: https://raw.githubusercontent.com/loverszhaokai/Cloud/master/John/dynamic_2001_failed_pw\r\n```\r\n$ ./configure --enable-asan && make -sj8\r\n$ ./john pwfile\r\n```\r\nWarning: invalid UTF-8 seen reading pwfile\r\n=================================================================\r\n==86914==ERROR: AddressSanitizer: unknown-crash on address 0x7fe530b7c777 at pc 0x5808a8 bp 0x7ffd523c8260 sp 0x7ffd523c8258\r\nREAD of size 138 at 0x7fe530b7c777 thread T0\r\n    #0 0x5808a7 in FindSaltHash /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/dynamic_fmt.c:2003\r\n    #1 0x5809fb in HashSalt /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/dynamic_fmt.c:2021\r\n    #2 0x58592b in get_salt /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/dynamic_fmt.c:2343\r\n    #3 0x950b51 in ldr_load_pw_line /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:916\r\n    #4 0x94b503 in read_file /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:135\r\n    #5 0x951e4e in ldr_load_pw_file /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:1019\r\n    #6 0x94758c in john_load /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1023\r\n    #7 0x948ceb in john_init /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1307\r\n    #8 0x94a8b3 in main /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1748\r\n    #9 0x7fe535ad9ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n    #10 0x406de8 (/home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/run/john+0x406de8)\r\n\r\n0x7fe530b7c800 is located 0 bytes to the right of 393216-byte region [0x7fe530b1c800,0x7fe530b7c800)\r\nallocated by thread T0 here:\r\n    #0 0x7fe5372b47df in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x547df)\r\n    #1 0x96fb4e in mem_alloc_func /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/memory.c:89\r\n    #2 0x96fdae in mem_alloc_tiny_func /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/memory.c:196\r\n    #3 0x5802c1 in AddSaltHash /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/dynamic_fmt.c:1969\r\n    #4 0x58073b in FindSaltHash /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/dynamic_fmt.c:1998\r\n    #5 0x5809fb in HashSalt /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/dynamic_fmt.c:2021\r\n    #6 0x58592b in get_salt /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/dynamic_fmt.c:2343\r\n    #7 0x950b51 in ldr_load_pw_line /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:916\r\n    #8 0x94b503 in read_file /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:135\r\n    #9 0x951e4e in ldr_load_pw_file /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/loader.c:1019\r\n    #10 0x94758c in john_load /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1023\r\n    #11 0x948ceb in john_init /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1307\r\n    #12 0x94a8b3 in main /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1748\r\n    #13 0x7fe535ad9ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n\r\nSUMMARY: AddressSanitizer: unknown-crash /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/dynamic_fmt.c:2003 FindSaltHash\r\nShadow bytes around the buggy address:\r\n  0x0ffd26167890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ffd261678a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ffd261678b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ffd261678c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ffd261678d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x0ffd261678e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[00]00\r\n  0x0ffd261678f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ffd26167900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0ffd26167910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0ffd26167920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0ffd26167930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07\r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Contiguous container OOB:fc\r\n  ASan internal:           fe\r\n==86914==ABORTING\r\nAborted (core dumped)\r\n```\r\n\r\n# 2. gdb Debug\r\n\r\n```C\r\n(gdb) bt\r\n#0  0x00007ffff5790cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56\r\n#1  0x00007ffff57940d8 in __GI_abort () at abort.c:89\r\n#2  0x00007ffff6f640e9 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#3  0x00007ffff6f5bde5 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#4  0x00007ffff6f5fbe2 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#5  0x00007ffff6f5b279 in __asan_report_error () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#6  0x00007ffff6f5c2a1 in __asan_report_load_n () from /usr/lib/x86_64-linux-gnu/libasan.so.1\r\n#7  0x00000000005808a8 in FindSaltHash (salt=0x7ffffffcdd30 \"@400001aDNNojYGSc7pSzcdxKxhbqvLtE\", '$' <repeats 100 times>, \"e4deG\\336\\367\\377\\177\", len=138, crc=3826882950)\r\n    at dynamic_fmt.c:2003\r\n#8  0x00000000005809fc in HashSalt (salt=0x7ffffffcdd30 \"@400001aDNNojYGSc7pSzcdxKxhbqvLtE\", '$' <repeats 100 times>, \"e4deG\\336\\367\\377\\177\", len=138)\r\n    at dynamic_fmt.c:2021\r\n#9  0x000000000058592c in get_salt (\r\n    ciphertext=0xf4ee40 <out> \"$dynamic_2001$ed52af63d8ecf0c682442dfef5f36391$1aDNNojYGSc7pSzcdxKxhbqvLtE\", '$' <repeats 100 times>, \"e4deG\") at dynamic_fmt.c:2343\r\n#10 0x0000000000950b52 in ldr_load_pw_line (db=0x1225e80 <database>,\r\n    line=0x7ffffffce6a0 \"$dynamic_2001$ed52af63d8ecf0c682442dfef5f36391$1aDNNojYGSc7pSzcdxKxhbqvLtE\", '$' <repeats 100 times>, \"e4deG\") at loader.c:916\r\n#11 0x000000000094b504 in read_file (db=0x1225e80 <database>, name=0x631000000868 \"pwfile\", flags=2, process_line=0x94fd2d <ldr_load_pw_line>) at loader.c:135\r\n#12 0x0000000000951e4f in ldr_load_pw_file (db=0x1225e80 <database>, name=0x631000000868 \"pwfile\") at loader.c:1019\r\n#13 0x000000000094758d in john_load () at john.c:1023\r\n#14 0x0000000000948cec in john_init (name=0x7fffffffec3f \"john\", argc=2, argv=0x7fffffffe9a8) at john.c:1307\r\n#15 0x000000000094a8b4 in main (argc=2, argv=0x7fffffffe9a8) at john.c:1748\r\n(gdb)\r\n```"},"comment":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/comments/120973314","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1554#issuecomment-120973314","issue_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1554","id":120973314,"user":{"login":"jfoug","id":1270024,"avatar_url":"https://avatars.githubusercontent.com/u/1270024?v=3","gravatar_id":"","url":"https://api.github.com/users/jfoug","html_url":"https://github.com/jfoug","followers_url":"https://api.github.com/users/jfoug/followers","following_url":"https://api.github.com/users/jfoug/following{/other_user}","gists_url":"https://api.github.com/users/jfoug/gists{/gist_id}","starred_url":"https://api.github.com/users/jfoug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfoug/subscriptions","organizations_url":"https://api.github.com/users/jfoug/orgs","repos_url":"https://api.github.com/users/jfoug/repos","events_url":"https://api.github.com/users/jfoug/events{/privacy}","received_events_url":"https://api.github.com/users/jfoug/received_events","type":"User","site_admin":false},"created_at":"2015-07-13T15:44:09Z","updated_at":"2015-07-13T15:44:09Z","body":"Another very good catch."}}