Skip to content

salted-sha1-opencl: Autotune bugfixes#5889

Merged
magnumripper merged 1 commit intoopenwall:bleeding-jumbofrom
magnumripper:quickie
Nov 14, 2025
Merged

salted-sha1-opencl: Autotune bugfixes#5889
magnumripper merged 1 commit intoopenwall:bleeding-jumbofrom
magnumripper:quickie

Conversation

@magnumripper
Copy link
Member

@magnumripper magnumripper commented Nov 14, 2025

Problems found while working on something else. Even segfaulted under certain conditions.

Comment on lines 849 to 852
new_salt.len = strlen("Hello");
memset(&new_salt, 0, SALT_SIZE);
memcpy(new_salt.data.c, "Hello", new_salt.len);
strcpy((char*)new_salt.data.c, "Hello");
new_salt.len = strlen((char*)new_salt.data.c);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stumbled upon this by coincidence. New_salt.len would always end up as 0, screwing up the autotune.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We generally do want to initialize the entire binary salt structs, or else comparisons for same/different salts don't work reliably. Probably irrelevant here, but maybe it'd be better to swap the old new_salt.len assignment and memset lines instead of switching to strcpy? Or switch to strncpy along with a comment that NUL padding is intentional.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Besides salt comparisons, we may also copy salts up to SALT_SIZE, and reading uninitialized data is just not right - may be detected by various sanitizers or even hardware later on.

Copy link
Member Author

@magnumripper magnumripper Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't in set_salt(), it's part of the autotune constructing a salt not from a test vector using its own half assed code. I guess something like set_salt(get_salt(fmt_opencl_salted_sha1.params.tests[0].ciphertext)); would do it better in one, albeit long line, lol (and something like that is what we do in the shared code, I'm pretty sure).


static void create_clobj_kpc(size_t kpc)
{
global_work_size = kpc;
Copy link
Member Author

@magnumripper magnumripper Nov 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was needed to ensure clear_keys() did not use some outdated value for gws, memsetting past buffer and b00m. I only ever saw it happen under the Test Suite, no idea why.

The ultimate problem is the format has its own autotune, not quite by our "conventions".

Copy link
Member

@solardiz solardiz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving, but I also made a comment.

Comment on lines 849 to 852
new_salt.len = strlen("Hello");
memset(&new_salt, 0, SALT_SIZE);
memcpy(new_salt.data.c, "Hello", new_salt.len);
strcpy((char*)new_salt.data.c, "Hello");
new_salt.len = strlen((char*)new_salt.data.c);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We generally do want to initialize the entire binary salt structs, or else comparisons for same/different salts don't work reliably. Probably irrelevant here, but maybe it'd be better to swap the old new_salt.len assignment and memset lines instead of switching to strcpy? Or switch to strncpy along with a comment that NUL padding is intentional.

@magnumripper
Copy link
Member Author

I guess something like set_salt(get_salt(fmt_opencl_salted_sha1.params.tests[0].ciphertext)); would do it better

I actually tried the above and it worked right off the bat. So I pushed that fix instead!

@magnumripper magnumripper merged commit 5663107 into openwall:bleeding-jumbo Nov 14, 2025
26 of 32 checks passed
@magnumripper magnumripper deleted the quickie branch November 14, 2025 08:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants