{"action":"created","issue":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/2239","repository_url":"https://api.github.com/repos/magnumripper/JohnTheRipper","labels_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/2239/labels{/name}","comments_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/2239/comments","events_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/2239/events","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/2239","id":173431530,"number":2239,"title":"ASan errors in prepare(), split(), valid(), etc. in various formats","user":{"login":"frank-dittrich","id":2026819,"avatar_url":"https://avatars.githubusercontent.com/u/2026819?v=3","gravatar_id":"","url":"https://api.github.com/users/frank-dittrich","html_url":"https://github.com/frank-dittrich","followers_url":"https://api.github.com/users/frank-dittrich/followers","following_url":"https://api.github.com/users/frank-dittrich/following{/other_user}","gists_url":"https://api.github.com/users/frank-dittrich/gists{/gist_id}","starred_url":"https://api.github.com/users/frank-dittrich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frank-dittrich/subscriptions","organizations_url":"https://api.github.com/users/frank-dittrich/orgs","repos_url":"https://api.github.com/users/frank-dittrich/repos","events_url":"https://api.github.com/users/frank-dittrich/events{/privacy}","received_events_url":"https://api.github.com/users/frank-dittrich/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":34,"created_at":"2016-08-26T11:26:42Z","updated_at":"2016-08-26T17:21:01Z","closed_at":null,"body":"```\r\n(bleeding-jumbo)run $ cat fail_Raw-SHA1-AxCrypt.pw \r\n2a53e6ef507fabede6032a934c21aafc$\r\n(bleeding-jumbo)run $ ./john --session=fdtest --format=Raw-SHA1-AxCrypt fail_Raw-SHA1-AxCrypt.pw \r\n=================================================================\r\n==26791==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000f468a9 at pc 0x7f51a0ddab32 bp 0x7ffe4ca2f600 sp 0x7ffe4ca2ed90\r\nWRITE of size 42 at 0x000000f468a9 thread T0\r\n    #0 0x7f51a0ddab31 in vsprintf (/lib64/libasan.so.3+0x8fb31)\r\n    #1 0x7f51a0ddad62 in sprintf (/lib64/libasan.so.3+0x8fd62)\r\n    #2 0x71156f in rawsha1_axcrypt_prepare /home/fd/git/JtR/src/rawSHA1_common_plug.c:120\r\n    #3 0x7a0556 in ldr_split_line /home/fd/git/JtR/src/loader.c:804\r\n    #4 0x7a1001 in ldr_load_pw_line /home/fd/git/JtR/src/loader.c:922\r\n    #5 0x7a27f8 in read_file /home/fd/git/JtR/src/loader.c:226\r\n    #6 0x7a5c44 in ldr_load_pw_file /home/fd/git/JtR/src/loader.c:1115\r\n    #7 0x798c8a in john_load /home/fd/git/JtR/src/john.c:1169\r\n    #8 0x79a4b2 in john_init /home/fd/git/JtR/src/john.c:1496\r\n    #9 0x79c300 in main /home/fd/git/JtR/src/john.c:1954\r\n    #10 0x7f519f2bf730 in __libc_start_main (/lib64/libc.so.6+0x20730)\r\n    #11 0x405df8 in _start (/home/fd/git/JtR/run/john+0x405df8)\r\n\r\n0x000000f468a9 is located 55 bytes to the left of global variable 'out' defined in 'rawSHA1_common_plug.c:94:14' (0xf468e0) of size 34\r\n0x000000f468a9 is located 0 bytes to the right of global variable 'out' defined in 'rawSHA1_common_plug.c:115:14' (0xf46880) of size 41\r\nSUMMARY: AddressSanitizer: global-buffer-overflow (/lib64/libasan.so.3+0x8fb31) in vsprintf\r\nShadow bytes around the buggy address:\r\n  0x0000801e0cc0: 00 06 f9 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9\r\n  0x0000801e0cd0: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9\r\n  0x0000801e0ce0: 00 00 04 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00\r\n  0x0000801e0cf0: 00 00 00 00 00 00 00 06 f9 f9 f9 f9 00 00 04 f9\r\n  0x0000801e0d00: f9 f9 f9 f9 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9\r\n=>0x0000801e0d10: 00 00 00 00 00[01]f9 f9 f9 f9 f9 f9 00 00 00 00\r\n  0x0000801e0d20: 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 02 f9 f9 f9\r\n  0x0000801e0d30: f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9 00 00 00 00\r\n  0x0000801e0d40: 00 00 00 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9\r\n  0x0000801e0d50: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9\r\n  0x0000801e0d60: 04 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==26791==ABORTING\r\n(bleeding-jumbo)run $ \r\n```"},"comment":{"url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/comments/242796590","html_url":"https://github.com/magnumripper/JohnTheRipper/issues/2239#issuecomment-242796590","issue_url":"https://api.github.com/repos/magnumripper/JohnTheRipper/issues/2239","id":242796590,"user":{"login":"jfoug","id":1270024,"avatar_url":"https://avatars.githubusercontent.com/u/1270024?v=3","gravatar_id":"","url":"https://api.github.com/users/jfoug","html_url":"https://github.com/jfoug","followers_url":"https://api.github.com/users/jfoug/followers","following_url":"https://api.github.com/users/jfoug/following{/other_user}","gists_url":"https://api.github.com/users/jfoug/gists{/gist_id}","starred_url":"https://api.github.com/users/jfoug/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jfoug/subscriptions","organizations_url":"https://api.github.com/users/jfoug/orgs","repos_url":"https://api.github.com/users/jfoug/repos","events_url":"https://api.github.com/users/jfoug/events{/privacy}","received_events_url":"https://api.github.com/users/jfoug/received_events","type":"User","site_admin":false},"created_at":"2016-08-26T17:21:01Z","updated_at":"2016-08-26T17:21:01Z","body":"It looks like many of these formats are 'newer'.  Probably since the last time you and others fuzzed the hell out of the formats looking for asan problems.   Some of these triggered with the new hexlen?() changes, but others were simply asan overflows and even actual SEGV cores waiting for the right bogus data to trip up the validation function."}}
{"actor":{"display_login":"jfoug"}}