{"action":"opened","issue":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1360","labels_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1360/labels{/name}","comments_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1360/comments","events_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1360/events","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1360","id":81246864,"number":1360,"title":"External mode: asan error heap buffer overflow","user":{"login":"loverszhaokai","id":2187242,"avatar_url":"https://avatars.githubusercontent.com/u/2187242?v=3","gravatar_id":"","url":"https://api.github.com/users/loverszhaokai","html_url":"https://github.com/loverszhaokai","followers_url":"https://api.github.com/users/loverszhaokai/followers","following_url":"https://api.github.com/users/loverszhaokai/following{/other_user}","gists_url":"https://api.github.com/users/loverszhaokai/gists{/gist_id}","starred_url":"https://api.github.com/users/loverszhaokai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/loverszhaokai/subscriptions","organizations_url":"https://api.github.com/users/loverszhaokai/orgs","repos_url":"https://api.github.com/users/loverszhaokai/repos","events_url":"https://api.github.com/users/loverszhaokai/events{/privacy}","received_events_url":"https://api.github.com/users/loverszhaokai/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-27T03:01:59Z","updated_at":"2015-05-27T03:01:59Z","closed_at":null,"body":"# 1. Analysis\r\n\r\nThis bug is similar to https://github.com/magnumripper/JohnTheRipper/issues/1358. But this bug is heap buffer overflow, maybe they are different bugs or same bugs.\r\n\r\n# 2. Reproduce\r\n\r\n$ ./configure --enable-asan && make -sj8\r\n$ cat test_pw\r\n```\r\n$apr1$a2Jqm...$grFrwEgiQleDr0zR4Jx1b.\r\n```\r\n$ cat local.conf\r\n```C\r\n[List.External:Lanman]\r\nint numbers[10];\r\nint lowers[26];\r\nint uppers[26];\r\nint symbols[32];\r\nint boundaries_charclass[4];\r\nint boundaries_numbers[10];\r\nint boundaries_letters[26];\r\nint boundaries_symbols[32];\r\nint seed;\r\nint password_length;\r\nvoid init()\r\n{\r\n\tpassword_length = 16; /* Change this to match config */\r\n\r\n\tint c, i;\r\n\r\n\tc = '0'; i = 0; while (c <= '9') numbers[i++] = c++;\r\n\tc = 'a'; i = 0; while (c <= 'z') lowers[i++] = c++;\r\n\tc = 'A'; i = 0; while (c <= 'Z') uppers[i++] = c++;\r\n\r\n\t/* Symbols */\r\n\ti = 0;\r\n\tsymbols[i++] = '!'; symbols[i++] = '@'; symbols[i++] = '#'; symbols[i++] = '$';\r\n\tsymbols[i++] = '%'; symbols[i++] = '^'; symbols[i++] = '&'; symbols[i++] = '*';\r\n\tsymbols[i++] = '('; symbols[i++] = ')'; symbols[i++] = '~'; symbols[i++] = '-';\r\n\tsymbols[i++] = '_'; symbols[i++] = '='; symbols[i++] = '+'; symbols[i++] = '\\\\';\r\n\tsymbols[i++] = '|'; symbols[i++] = '/'; symbols[i++] = '['; symbols[i++] = ']';\r\n\tsymbols[i++] = '{'; symbols[i++] = '}'; symbols[i++] = ';'; symbols[i++] = ':';\r\n\tsymbols[i++] = '`'; symbols[i++] = '\\''; symbols[i++] = '\"'; symbols[i++] = ',';\r\n\tsymbols[i++] = '.'; symbols[i++] = '<'; symbols[i++] = '>'; symbols[i++] = '?';\r\n\r\n\ti = 0;\r\n\tboundaries_charclass[i++] = 536870912; boundaries_charclass[i++] = 1073741824;\r\n\tboundaries_charclass[i++] = 1610612736; boundaries_charclass[i++] = 2147483647;\r\n\r\n\ti = 0;\r\n\tboundaries_numbers[i++] = 214748365; boundaries_numbers[i++] = 429496730;\r\n\tboundaries_numbers[i++] = 644245095; boundaries_numbers[i++] = 858993460;\r\n\tboundaries_numbers[i++] = 1073741824; boundaries_numbers[i++] = 1288490189;\r\n\tboundaries_numbers[i++] = 1503238554; boundaries_numbers[i++] = 1717986919;\r\n\tboundaries_numbers[i++] = 193273=284; boundaries_numbers[i++] = 2147483647;\r\n\r\n}\r\n\r\nvoid generate()\r\n{\r\n}\r\n\r\n\r\nvoid restore()\r\n{\r\n}\r\n```\r\n$ ../john test_pw --format=md5crypt --external=lanman --config=local.conf\r\n```C\r\n=================================================================\r\n==108368==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000010278 at pc 0x72749d bp 0x7ffe82c1dcd0 sp 0x7ffe82c1dcc8\r\nREAD of size 4 at 0x617000010278 thread T0\r\n    #0 0x72749c in c_execute_fast /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/compiler.c:1107\r\n    #1 0x72f5d9 in ext_init /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/external.c:190\r\n    #2 0x73f024 in john_load /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:922\r\n    #3 0x741149 in john_init /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1280\r\n    #4 0x742ca5 in main /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/john.c:1707\r\n    #5 0x7f93bf65dec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)\r\n    #6 0x406c72 (/home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/run/john+0x406c72)\r\n\r\nAddressSanitizer can not describe address in more detail (wild memory access suspected).\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/zhaokai/WorkSpace/open_wall/JohnTheRipper_kai/src/compiler.c:1107 c_execute_fast\r\nShadow bytes around the buggy address:\r\n  0x0c2e7fff9ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c2e7fffa000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c2e7fffa010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c2e7fffa020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c2e7fffa030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n=>0x0c2e7fffa040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]\r\n  0x0c2e7fffa050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c2e7fffa060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c2e7fffa070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c2e7fffa080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c2e7fffa090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07\r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Contiguous container OOB:fc\r\n  ASan internal:           fe\r\n==108368==ABORTING\r\nAborted\r\n```\r\n"}}