1592
[REF-291]Johnny Shelley. "bcrypt". < http://bcrypt.sourceforge.net/ >.
[REF-292]Colin Percival. "Tarsnap - The scrypt key derivation function and encryption utility". <
http://www.tarsnap.com/scrypt.html >.
[REF-293]B. Kaliski. "RFC2898 - PKCS #5: Password-Based Cryptography Specification Version
2.0". 2000. < https://www.rfc-editor.org/rfc/rfc2898 >.2023-04-07.
[REF-294]Coda Hale. "How To Safely Store A Password". 2010 January 1. < https://codahale.com/
how-to-safely-store-a-password/ >.2023-04-07.
[REF-295]Brian Krebs. "How Companies Can Beef Up Password Security (interview with Thomas
H. Ptacek)". 2012 June 1. < https://krebsonsecurity.com/2012/06/how-companies-can-beef-uppassword-
security/ >.2023-04-07.
[REF-296]Solar Designer. "Password security: past, present, future". 2012. < https://
www.openwall.com/presentations/PHDays2012-Password-Security/ >.2023-04-07.
[REF-297]Troy Hunt. "Our password hashing has no clothes". 2012 June 6. < https://
www.troyhunt.com/our-password-hashing-has-no-clothes/ >.2023-04-07.
[REF-298]Joshbw. "Should we really use bcrypt/scrypt?". 2012 June 8. < https://web.archive.org/
web/20120629144851/http://www.analyticalengine.net/2012/06/should-we-really-use-bcryptscrypt/
>.2023-04-07.
[REF-631]OWASP. "Password Storage Cheat Sheet". < https://cheatsheetseries.owasp.org/
cheatsheets/Password_Storage_Cheat_Sheet.html >.2023-04-07.
[REF-632]Thomas Ptacek. "Enough With The Rainbow Tables: What You Need To Know About
Secure Password Schemes". 2007 September 0. < http://hashphp.org/hashing.html >.2023-04-07.
[REF-633]Robert Graham. "The Importance of Being Canonical". 2009 February 2. < https://
blog.erratasec.com/2009/02/importance-of-being-canonical.html#.ZCbyY7LMJPY >.2023-04-07.
[REF-634]James McGlinn. "Password Hashing". < https://privacyaustralia.net/phpsec/articles/
password-hashing/ >.2023-04-07.
[REF-635]Jeff Atwood. "Rainbow Hash Cracking". 2007 September 8. < https://
blog.codinghorror.com/rainbow-hash-cracking/ >.2023-04-07.
[REF-636]Jeff Atwood. "Speed Hashing". 2012 April 6. < https://blog.codinghorror.com/speedhashing/
>.2023-04-07.
[REF-637]"Rainbow table". 2009 March 3. Wikipedia. < https://en.wikipedia.org/wiki/Rainbow_table
>.2023-04-07.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-761: Free of Pointer not at Start of Buffer
Weakness ID : 761
Structure : Simple
Abstraction : Variant
Description
The product calls free() on a pointer to a memory resource that was allocated on the heap, but the
pointer is not at the start of the buffer.
Extended Description
CWE Version 4.14
CWE-761: Free of Pointer not at Start of Buffer
CWE-761: Free of Pointer not at Start of Buffer