From e9bc4caed371f6038685d287952ff26279eb4a41 Mon Sep 17 00:00:00 2001 From: Gabriele 'matrix' Gristina Date: Sun, 17 Jan 2016 18:52:25 +0100 Subject: [PATCH 1/2] Fixed a buffer overflow in ascii_digest for hash type 8300 --- src/shared.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/shared.c b/src/shared.c index ef29ce46f..9af47ba5d 100644 --- a/src/shared.c +++ b/src/shared.c @@ -7109,9 +7109,7 @@ void ascii_digest (char out_buf[4096], uint salt_pos, uint digest_pos) } else if (hash_mode == 8300) { - // todo - - char digest_buf_c[33]; + char digest_buf_c[56] = { 0 }; base32_encode (int_to_itoa32, (const u8 *) digest_buf, 32, (u8 *) digest_buf_c); @@ -7121,7 +7119,7 @@ void ascii_digest (char out_buf[4096], uint salt_pos, uint digest_pos) const uint salt_pc_len = salt.salt_buf_pc[7]; // what a hack - char domain_buf_c[33]; + char domain_buf_c[33] = { 0 }; memcpy (domain_buf_c, (char *) salt.salt_buf_pc, salt_pc_len); From 29636ca0a3031deecd9fedb188fad50af686a64c Mon Sep 17 00:00:00 2001 From: Gabriele 'matrix' Gristina Date: Sun, 17 Jan 2016 22:10:19 +0100 Subject: [PATCH 2/2] Re-fix ascii_digest --- src/shared.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/shared.c b/src/shared.c index 9af47ba5d..a508d75b3 100644 --- a/src/shared.c +++ b/src/shared.c @@ -7109,9 +7109,9 @@ void ascii_digest (char out_buf[4096], uint salt_pos, uint digest_pos) } else if (hash_mode == 8300) { - char digest_buf_c[56] = { 0 }; + char digest_buf_c[34] = { 0 }; - base32_encode (int_to_itoa32, (const u8 *) digest_buf, 32, (u8 *) digest_buf_c); + base32_encode (int_to_itoa32, (const u8 *) digest_buf, 20, (u8 *) digest_buf_c); digest_buf_c[32] = 0;