{"action":"created","issue":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1917","labels_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1917/labels{/name}","comments_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1917/comments","events_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1917/events","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1917","id":118797246,"number":1917,"title":"ASan error for --format=sapg on 32-bit NEON","user":{"login":"frank-dittrich","id":2026819,"avatar_url":"https://avatars.githubusercontent.com/u/2026819?v=3","gravatar_id":"","url":"https://api.github.com/users/frank-dittrich","html_url":"https://github.com/frank-dittrich","followers_url":"https://api.github.com/users/frank-dittrich/followers","following_url":"https://api.github.com/users/frank-dittrich/following{/other_user}","gists_url":"https://api.github.com/users/frank-dittrich/gists{/gist_id}","starred_url":"https://api.github.com/users/frank-dittrich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frank-dittrich/subscriptions","organizations_url":"https://api.github.com/users/frank-dittrich/orgs","repos_url":"https://api.github.com/users/frank-dittrich/repos","events_url":"https://api.github.com/users/frank-dittrich/events{/privacy}","received_events_url":"https://api.github.com/users/frank-dittrich/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2015-11-25T09:45:08Z","updated_at":"2015-11-29T15:40:27Z","closed_at":"2015-11-29T09:29:02Z","body":"After getting a segfault for SAP F/G format without a useful backtrace (stack corrupted), I decided to try an ASan build.\r\n\r\n```\r\ntest $ ../run/john -ses=tst-  -pot=tst-.pot sapf_tst.in --wordlist=sapf_utf8.dic -enc=utf8 --format=sapg\r\nLoaded 6794 password hashes with 48 different salts (sapg, SAP CODVN F/G (PASSCODE) [SHA1 128/128 NEON 4x])\r\nPress 'q' or Ctrl-C to abort, almost any other key for status\r\n𠺢𠻗𠻹𠻺𠼭            (A€)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCDEFGH)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCDEFGHIJK)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCDEFGHIJ)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (A)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (ABC)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCDEFG)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä)\r\n𠺢𠻗𠻹𠻺𠼭            (AB)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCDEFGHI)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCDEFGHIJKL)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCDEF)\r\n𠺢𠻗𠻹𠻺𠼭            (€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (Ä€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCD)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (A€€€€€)\r\n𠺢𠻗𠻹𠻺𠼭            (€€)\r\n𠺢𠻗𠻹𠻺𠼭            (ABCDE)\r\n𠺢𠻗𠻹𠻺𠼭            (𠜎𠜱𠝹𠱓𠱸𠲖)\r\n=================================================================\r\n==30476==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7eec0649 at pc 0x76a46f88 bp 0x7eec0584 sp 0x7eec0158\r\nWRITE of size 111 at 0x7eec0649 thread T0\r\n    #0 0x76a46f87 in strcpy (/usr/lib/arm-linux-gnueabihf/libasan.so.1+0x2bf87)\r\n    #1 0x3b5493 in crypt_all /home/pi/JtR/src/sapG_fmt_plug.c:466\r\n    #2 0x41d35f in crk_password_loop /home/pi/JtR/src/cracker.c:728\r\n    #3 0x41e7b3 in crk_salt_loop /home/pi/JtR/src/cracker.c:875\r\n    #4 0x41ebd7 in crk_process_key /home/pi/JtR/src/cracker.c:925\r\n    #5 0x488d8f in do_wordlist_crack /home/pi/JtR/src/wordlist.c:1321\r\n    #6 0x43e85f in john_run /home/pi/JtR/src/john.c:1689\r\n    #7 0x43f8a7 in main /home/pi/JtR/src/john.c:1965\r\n    #8 0x765e7293 in __libc_start_main (/lib/arm-linux-gnueabihf/libc.so.6+0x18293)\r\n\r\nAddress 0x7eec0649 is located in stack of thread T0 at offset 137 in frame\r\n    #0 0x3b52ef in crypt_all /home/pi/JtR/src/sapG_fmt_plug.c:436\r\n\r\n  This frame has 2 object(s):\r\n    [32, 48) 'crypt_len'\r\n    [96, 137) 'buf_aligned' <== Memory access at offset 137 overflows this variable\r\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext\r\n      (longjmp and C++ exceptions *are* supported)\r\nSUMMARY: AddressSanitizer: stack-buffer-overflow ??:0 strcpy\r\nShadow bytes around the buggy address:\r\n  0x2fdd8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x2fdd8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x2fdd8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x2fdd80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x2fdd80b0: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f4 f4\r\n=>0x2fdd80c0: f2 f2 f2 f2 00 00 00 00 00[01]f4 f4 f3 f3 f3 f3\r\n  0x2fdd80d0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1\r\n  0x2fdd80e0: 04 f4 f4 f4 f2 f2 f2 f2 00 f4 f4 f4 f3 f3 f3 f3\r\n  0x2fdd80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x2fdd8100: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00\r\n  0x2fdd8110: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Contiguous container OOB:fc\r\n  ASan internal:           fe\r\n==30476==ABORTING\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/comments/160423062","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/1917#issuecomment-160423062","issue_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/1917","id":160423062,"user":{"login":"magnumripper","id":1268598,"avatar_url":"https://avatars.githubusercontent.com/u/1268598?v=3","gravatar_id":"","url":"https://api.github.com/users/magnumripper","html_url":"https://github.com/magnumripper","followers_url":"https://api.github.com/users/magnumripper/followers","following_url":"https://api.github.com/users/magnumripper/following{/other_user}","gists_url":"https://api.github.com/users/magnumripper/gists{/gist_id}","starred_url":"https://api.github.com/users/magnumripper/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magnumripper/subscriptions","organizations_url":"https://api.github.com/users/magnumripper/orgs","repos_url":"https://api.github.com/users/magnumripper/repos","events_url":"https://api.github.com/users/magnumripper/events{/privacy}","received_events_url":"https://api.github.com/users/magnumripper/received_events","type":"User","site_admin":false},"created_at":"2015-11-29T15:40:26Z","updated_at":"2015-11-29T15:40:26Z","body":"The 32-bit read triggers a (benign) read error - reading 4 bytes at position 121. We now allocate 126 bytes so it doesn't happen anymore."}}