{"action":"created","issue":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1956","labels_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1956/labels{/name}","comments_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1956/comments","events_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1956/events","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1956","id":122617182,"number":1956,"title":"ASan error in vdi format ","user":{"login":"frank-dittrich","id":2026819,"avatar_url":"https://avatars.githubusercontent.com/u/2026819?v=3","gravatar_id":"","url":"https://api.github.com/users/frank-dittrich","html_url":"https://github.com/frank-dittrich","followers_url":"https://api.github.com/users/frank-dittrich/followers","following_url":"https://api.github.com/users/frank-dittrich/following{/other_user}","gists_url":"https://api.github.com/users/frank-dittrich/gists{/gist_id}","starred_url":"https://api.github.com/users/frank-dittrich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frank-dittrich/subscriptions","organizations_url":"https://api.github.com/users/frank-dittrich/orgs","repos_url":"https://api.github.com/users/frank-dittrich/repos","events_url":"https://api.github.com/users/frank-dittrich/events{/privacy}","received_events_url":"https://api.github.com/users/frank-dittrich/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/labels/bug","name":"bug","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/milestones/2","html_url":"https://github.com/magnumripper/JohnTheRipper/milestones/1.8.0-jumbo-2","labels_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/milestones/2/labels","id":492145,"number":2,"title":"1.8.0-jumbo-2","description":"Please assign ALL issues which should be in J2 to this milestone, and lets push forward in fixing all of them.","creator":{"login":"magnumripper","id":1268598,"avatar_url":"https://avatars.githubusercontent.com/u/1268598?v=3","gravatar_id":"","url":"https://api.github.com/users/magnumripper","html_url":"https://github.com/magnumripper","followers_url":"https://api.github.com/users/magnumripper/followers","following_url":"https://api.github.com/users/magnumripper/following{/other_user}","gists_url":"https://api.github.com/users/magnumripper/gists{/gist_id}","starred_url":"https://api.github.com/users/magnumripper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magnumripper/subscriptions","organizations_url":"https://api.github.com/users/magnumripper/orgs","repos_url":"https://api.github.com/users/magnumripper/repos","events_url":"https://api.github.com/users/magnumripper/events{/privacy}","received_events_url":"https://api.github.com/users/magnumripper/received_events","type":"User","site_admin":false},"open_issues":23,"closed_issues":241,"state":"open","created_at":"2013-11-21T06:59:25Z","updated_at":"2015-12-17T00:03:41Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2015-12-16T22:22:45Z","updated_at":"2015-12-17T16:36:07Z","closed_at":null,"body":"```\r\n$ ./john --test=0 --format=vdi\r\nTesting: vdi, VirtualBox-VDI AES_XTS [PBKDF2-SHA256 128/128 AVX 4x + AES_XTS]... =================================================================\r\n==9361==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001d163a0 at pc 0x000000575d45 bp 0x7ffc2c6cb010 sp 0x7ffc2c6cb008\r\nWRITE of size 1 at 0x000001d163a0 thread T0\r\n    #0 0x575d44 in hex_to_raw /home/fd/git/JtR/src/base64_convert.c:247:2\r\n    #1 0x5749ac in base64_convert /home/fd/git/JtR/src/base64_convert.c:802:6\r\n    #2 0x7f5b21 in binary /home/fd/git/JtR/src/vdi_fmt_plug.c:353:2\r\n    #3 0x844f27 in ldr_load_pw_line /home/fd/git/JtR/src/loader.c:850:12\r\n    #4 0x846663 in ldr_init_test_db /home/fd/git/JtR/src/loader.c:1094:3\r\n    #5 0x80efe3 in benchmark_all /home/fd/git/JtR/src/bench.c:684:13\r\n    #6 0x834905 in john_run /home/fd/git/JtR/src/john.c:1585:17\r\n    #7 0x831ebf in main /home/fd/git/JtR/src/john.c:1970:2\r\n    #8 0x7f3d10a776ff in __libc_start_main (/lib64/libc.so.6+0x206ff)\r\n    #9 0x4dbc88 in _start (/home/fd/git/JtR/run/john+0x4dbc88)\r\n\r\n0x000001d163a0 is located 32 bytes to the left of global variable 'cur_salt' defined in 'vms_fmt_plug.c:182:30' (0x1d163c0) of size 8\r\n0x000001d163a0 is located 0 bytes to the right of global variable 'full' defined in 'vdi_fmt_plug.c:349:22' (0x1d16380) of size 32\r\nSUMMARY: AddressSanitizer: global-buffer-overflow /home/fd/git/JtR/src/base64_convert.c:247 hex_to_raw\r\nShadow bytes around the buggy address:\r\n  0x00008039ac20: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039ac30: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039ac40: f9 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039ac50: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00\r\n  0x00008039ac60: 00 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9\r\n=>0x00008039ac70: 00 00 00 00[f9]f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039ac80: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039ac90: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00\r\n  0x00008039aca0: 00 00 00 00 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039acb0: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039acc0: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  ASan internal:           fe\r\n==9361==ABORTING\r\n```\r\n\r\n```\r\n$ ./john --list=build-info \r\nVersion: 1.8.0.6-jumbo-1-1768-gd157e31\r\nBuild: linux-gnu 64-bit AVX-ac ASan\r\nSIMD: AVX, interleaving: MD4:4 MD5:5 SHA1:2 SHA256:1 SHA512:1\r\n$JOHN is ./\r\nFormat interface version: 13\r\nMax. number of reported tunable costs: 3\r\nRec file version: REC4\r\nCharset file version: CHR3\r\nCHARSET_MIN: 1 (0x01)\r\nCHARSET_MAX: 255 (0xff)\r\nCHARSET_LENGTH: 24\r\nSALT_HASH_SIZE: 1048576\r\nMax. Markov mode level: 400\r\nMax. Markov mode password length: 30\r\nclang version: 3.5.0 (tags/RELEASE_350/final) (gcc 4.3.0 compatibility)\r\nGNU libc version: 2.21 (loaded: 2.21)\r\nCrypto library: OpenSSL\r\nOpenSSL library version: 0100010bf\r\nOpenSSL 1.0.1k-fips 8 Jan 2015\r\nGMP library version: 6.0.0\r\nFile locking: fcntl()\r\nfseek(): fseek\r\nftell(): ftell\r\nfopen(): fopen\r\nmemmem(): System's\r\nBuilt with these debugging options\r\n\tASan (Address Sanitizer debugging)\r\n\r\n```\r\n\r\nSince one of the recent commits changed vdi, I just reproduced with the latest commit:\r\n```\r\n ./john --test=0 --format=vdi\r\nTesting: vdi, VirtualBox-VDI AES_XTS [PBKDF2-SHA256 128/128 AVX 4x + AES_XTS]... =================================================================\r\n==9595==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001d153a0 at pc 0x000000575d45 bp 0x7ffd28577310 sp 0x7ffd28577308\r\nWRITE of size 1 at 0x000001d153a0 thread T0\r\n    #0 0x575d44 in hex_to_raw /home/fd/git/JtR/src/base64_convert.c:247:2\r\n    #1 0x5749ac in base64_convert /home/fd/git/JtR/src/base64_convert.c:802:6\r\n    #2 0x7f5b21 in binary /home/fd/git/JtR/src/vdi_fmt_plug.c:358:2\r\n    #3 0x844f27 in ldr_load_pw_line /home/fd/git/JtR/src/loader.c:850:12\r\n    #4 0x846663 in ldr_init_test_db /home/fd/git/JtR/src/loader.c:1094:3\r\n    #5 0x80efe3 in benchmark_all /home/fd/git/JtR/src/bench.c:684:13\r\n    #6 0x834905 in john_run /home/fd/git/JtR/src/john.c:1585:17\r\n    #7 0x831ebf in main /home/fd/git/JtR/src/john.c:1970:2\r\n    #8 0x7fe18fab16ff in __libc_start_main (/lib64/libc.so.6+0x206ff)\r\n    #9 0x4dbc88 in _start (/home/fd/git/JtR/run/john+0x4dbc88)\r\n\r\n0x000001d153a0 is located 32 bytes to the left of global variable 'cur_salt' defined in 'vms_fmt_plug.c:182:30' (0x1d153c0) of size 8\r\n0x000001d153a0 is located 0 bytes to the right of global variable 'full' defined in 'vdi_fmt_plug.c:351:22' (0x1d15380) of size 32\r\nSUMMARY: AddressSanitizer: global-buffer-overflow /home/fd/git/JtR/src/base64_convert.c:247 hex_to_raw\r\nShadow bytes around the buggy address:\r\n  0x00008039aa20: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039aa30: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039aa40: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039aa50: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00\r\n  0x00008039aa60: 00 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9\r\n=>0x00008039aa70: 00 00 00 00[f9]f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039aa80: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039aa90: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00\r\n  0x00008039aaa0: 00 00 00 00 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039aab0: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008039aac0: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  ASan internal:           fe\r\n```"},"comment":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/comments/165503218","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1956#issuecomment-165503218","issue_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1956","id":165503218,"user":{"login":"jfoug","id":1270024,"avatar_url":"https://avatars.githubusercontent.com/u/1270024?v=3","gravatar_id":"","url":"https://api.github.com/users/jfoug","html_url":"https://github.com/jfoug","followers_url":"https://api.github.com/users/jfoug/followers","following_url":"https://api.github.com/users/jfoug/following{/other_user}","gists_url":"https://api.github.com/users/jfoug/gists{/gist_id}","starred_url":"https://api.github.com/users/jfoug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfoug/subscriptions","organizations_url":"https://api.github.com/users/jfoug/orgs","repos_url":"https://api.github.com/users/jfoug/repos","events_url":"https://api.github.com/users/jfoug/events{/privacy}","received_events_url":"https://api.github.com/users/jfoug/received_events","type":"User","site_admin":false},"created_at":"2015-12-17T16:36:07Z","updated_at":"2015-12-17T16:36:07Z","body":"9d7c057  I was null terminating a raw buffer !?!?!"}}