File: | common/md4.cpp |
Location: | line 199, column 1 |
Description: | Address of stack memory associated with local variable 'md' is still referred to by the global variable 'm' upon returning to the caller. This will be a dangling reference |
1 | /** |
2 | * @file |
3 | * @brief An implementation of MD4 designed for use in the samba SMB authentication protocol |
4 | * @note This code makes no attempt to be fast! |
5 | * @note It assumes that a int is at least 32 bits long |
6 | */ |
7 | |
8 | /* |
9 | Copyright (C) 1997-1998 Andrew Tridgell |
10 | |
11 | This program is free software; you can redistribute it and/or |
12 | modify it under the terms of the GNU General Public License |
13 | as published by the Free Software Foundation; either version 2 |
14 | of the License, or (at your option) any later version. |
15 | |
16 | This program is distributed in the hope that it will be useful, |
17 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
18 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
19 | |
20 | See the GNU General Public License for more details. |
21 | |
22 | You should have received a copy of the GNU General Public License |
23 | along with this program; if not, write to: |
24 | |
25 | Free Software Foundation, Inc. |
26 | 59 Temple Place - Suite 330 |
27 | Boston, MA 02111-1307, USA |
28 | |
29 | $Id$ |
30 | */ |
31 | |
32 | #include "../shared/shared.h" |
33 | #include "md4.h" |
34 | |
35 | static struct mdfour *m; |
36 | |
37 | #define F(X,Y,Z)(((X)&(Y)) | ((~(X))&(Z))) (((X)&(Y)) | ((~(X))&(Z))) |
38 | #define G(X,Y,Z)(((X)&(Y)) | ((X)&(Z)) | ((Y)&(Z))) (((X)&(Y)) | ((X)&(Z)) | ((Y)&(Z))) |
39 | #define H(X,Y,Z)((X)^(Y)^(Z)) ((X)^(Y)^(Z)) |
40 | #ifdef LARGE_INT32 |
41 | #define lshift(x,s)(((x)<<(s)) | ((x)>>(32 -(s)))) ((((x)<<(s))&0xFFFFFFFF) | (((x)>>(32-(s)))&0xFFFFFFFF)) |
42 | #else |
43 | #define lshift(x,s)(((x)<<(s)) | ((x)>>(32 -(s)))) (((x)<<(s)) | ((x)>>(32-(s)))) |
44 | #endif |
45 | |
46 | #define ROUND1(a,b,c,d,k,s)a = (((a + (((b)&(c)) | ((~(b))&(d))) + X[k])<< (s)) | ((a + (((b)&(c)) | ((~(b))&(d))) + X[k])>> (32 -(s)))) a = lshift(a + F(b,c,d) + X[k], s)(((a + (((b)&(c)) | ((~(b))&(d))) + X[k])<<(s)) | ((a + (((b)&(c)) | ((~(b))&(d))) + X[k])>>(32 -(s)))) |
47 | #define ROUND2(a,b,c,d,k,s)a = (((a + (((b)&(c)) | ((b)&(d)) | ((c)&(d))) + X [k] + 0x5A827999)<<(s)) | ((a + (((b)&(c)) | ((b)& (d)) | ((c)&(d))) + X[k] + 0x5A827999)>>(32 -(s)))) a = lshift(a + G(b,c,d) + X[k] + 0x5A827999,s)(((a + (((b)&(c)) | ((b)&(d)) | ((c)&(d))) + X[k] + 0x5A827999)<<(s)) | ((a + (((b)&(c)) | ((b)& (d)) | ((c)&(d))) + X[k] + 0x5A827999)>>(32 -(s)))) |
48 | #define ROUND3(a,b,c,d,k,s)a = (((a + ((b)^(c)^(d)) + X[k] + 0x6ED9EBA1)<<(s)) | ( (a + ((b)^(c)^(d)) + X[k] + 0x6ED9EBA1)>>(32 -(s)))) a = lshift(a + H(b,c,d) + X[k] + 0x6ED9EBA1,s)(((a + ((b)^(c)^(d)) + X[k] + 0x6ED9EBA1)<<(s)) | ((a + ((b)^(c)^(d)) + X[k] + 0x6ED9EBA1)>>(32 -(s)))) |
49 | |
50 | /* this applies md4 to 64 byte chunks */ |
51 | static void mdfour64 (uint32_t *M) |
52 | { |
53 | int j; |
54 | uint32_t AA, BB, CC, DD; |
55 | uint32_t X[16]; |
56 | uint32_t A, B, C, D; |
57 | |
58 | for (j = 0; j < 16; j++) |
59 | X[j] = M[j]; |
60 | |
61 | A = m->A; B = m->B; C = m->C; D = m->D; |
62 | AA = A; BB = B; CC = C; DD = D; |
63 | |
64 | ROUND1(A,B,C,D, 0, 3)A = (((A + (((B)&(C)) | ((~(B))&(D))) + X[0])<< (3)) | ((A + (((B)&(C)) | ((~(B))&(D))) + X[0])>> (32 -(3)))); ROUND1(D,A,B,C, 1, 7)D = (((D + (((A)&(B)) | ((~(A))&(C))) + X[1])<< (7)) | ((D + (((A)&(B)) | ((~(A))&(C))) + X[1])>> (32 -(7)))); |
65 | ROUND1(C,D,A,B, 2, 11)C = (((C + (((D)&(A)) | ((~(D))&(B))) + X[2])<< (11)) | ((C + (((D)&(A)) | ((~(D))&(B))) + X[2])>> (32 -(11)))); ROUND1(B,C,D,A, 3, 19)B = (((B + (((C)&(D)) | ((~(C))&(A))) + X[3])<< (19)) | ((B + (((C)&(D)) | ((~(C))&(A))) + X[3])>> (32 -(19)))); |
66 | ROUND1(A,B,C,D, 4, 3)A = (((A + (((B)&(C)) | ((~(B))&(D))) + X[4])<< (3)) | ((A + (((B)&(C)) | ((~(B))&(D))) + X[4])>> (32 -(3)))); ROUND1(D,A,B,C, 5, 7)D = (((D + (((A)&(B)) | ((~(A))&(C))) + X[5])<< (7)) | ((D + (((A)&(B)) | ((~(A))&(C))) + X[5])>> (32 -(7)))); |
67 | ROUND1(C,D,A,B, 6, 11)C = (((C + (((D)&(A)) | ((~(D))&(B))) + X[6])<< (11)) | ((C + (((D)&(A)) | ((~(D))&(B))) + X[6])>> (32 -(11)))); ROUND1(B,C,D,A, 7, 19)B = (((B + (((C)&(D)) | ((~(C))&(A))) + X[7])<< (19)) | ((B + (((C)&(D)) | ((~(C))&(A))) + X[7])>> (32 -(19)))); |
68 | ROUND1(A,B,C,D, 8, 3)A = (((A + (((B)&(C)) | ((~(B))&(D))) + X[8])<< (3)) | ((A + (((B)&(C)) | ((~(B))&(D))) + X[8])>> (32 -(3)))); ROUND1(D,A,B,C, 9, 7)D = (((D + (((A)&(B)) | ((~(A))&(C))) + X[9])<< (7)) | ((D + (((A)&(B)) | ((~(A))&(C))) + X[9])>> (32 -(7)))); |
69 | ROUND1(C,D,A,B, 10, 11)C = (((C + (((D)&(A)) | ((~(D))&(B))) + X[10])<< (11)) | ((C + (((D)&(A)) | ((~(D))&(B))) + X[10])>> (32 -(11)))); ROUND1(B,C,D,A, 11, 19)B = (((B + (((C)&(D)) | ((~(C))&(A))) + X[11])<< (19)) | ((B + (((C)&(D)) | ((~(C))&(A))) + X[11])>> (32 -(19)))); |
70 | ROUND1(A,B,C,D, 12, 3)A = (((A + (((B)&(C)) | ((~(B))&(D))) + X[12])<< (3)) | ((A + (((B)&(C)) | ((~(B))&(D))) + X[12])>> (32 -(3)))); ROUND1(D,A,B,C, 13, 7)D = (((D + (((A)&(B)) | ((~(A))&(C))) + X[13])<< (7)) | ((D + (((A)&(B)) | ((~(A))&(C))) + X[13])>> (32 -(7)))); |
71 | ROUND1(C,D,A,B, 14, 11)C = (((C + (((D)&(A)) | ((~(D))&(B))) + X[14])<< (11)) | ((C + (((D)&(A)) | ((~(D))&(B))) + X[14])>> (32 -(11)))); ROUND1(B,C,D,A, 15, 19)B = (((B + (((C)&(D)) | ((~(C))&(A))) + X[15])<< (19)) | ((B + (((C)&(D)) | ((~(C))&(A))) + X[15])>> (32 -(19)))); |
72 | |
73 | ROUND2(A,B,C,D, 0, 3)A = (((A + (((B)&(C)) | ((B)&(D)) | ((C)&(D))) + X [0] + 0x5A827999)<<(3)) | ((A + (((B)&(C)) | ((B)& (D)) | ((C)&(D))) + X[0] + 0x5A827999)>>(32 -(3)))); ROUND2(D,A,B,C, 4, 5)D = (((D + (((A)&(B)) | ((A)&(C)) | ((B)&(C))) + X [4] + 0x5A827999)<<(5)) | ((D + (((A)&(B)) | ((A)& (C)) | ((B)&(C))) + X[4] + 0x5A827999)>>(32 -(5)))); |
74 | ROUND2(C,D,A,B, 8, 9)C = (((C + (((D)&(A)) | ((D)&(B)) | ((A)&(B))) + X [8] + 0x5A827999)<<(9)) | ((C + (((D)&(A)) | ((D)& (B)) | ((A)&(B))) + X[8] + 0x5A827999)>>(32 -(9)))); ROUND2(B,C,D,A, 12, 13)B = (((B + (((C)&(D)) | ((C)&(A)) | ((D)&(A))) + X [12] + 0x5A827999)<<(13)) | ((B + (((C)&(D)) | ((C) &(A)) | ((D)&(A))) + X[12] + 0x5A827999)>>(32 - (13)))); |
75 | ROUND2(A,B,C,D, 1, 3)A = (((A + (((B)&(C)) | ((B)&(D)) | ((C)&(D))) + X [1] + 0x5A827999)<<(3)) | ((A + (((B)&(C)) | ((B)& (D)) | ((C)&(D))) + X[1] + 0x5A827999)>>(32 -(3)))); ROUND2(D,A,B,C, 5, 5)D = (((D + (((A)&(B)) | ((A)&(C)) | ((B)&(C))) + X [5] + 0x5A827999)<<(5)) | ((D + (((A)&(B)) | ((A)& (C)) | ((B)&(C))) + X[5] + 0x5A827999)>>(32 -(5)))); |
76 | ROUND2(C,D,A,B, 9, 9)C = (((C + (((D)&(A)) | ((D)&(B)) | ((A)&(B))) + X [9] + 0x5A827999)<<(9)) | ((C + (((D)&(A)) | ((D)& (B)) | ((A)&(B))) + X[9] + 0x5A827999)>>(32 -(9)))); ROUND2(B,C,D,A, 13, 13)B = (((B + (((C)&(D)) | ((C)&(A)) | ((D)&(A))) + X [13] + 0x5A827999)<<(13)) | ((B + (((C)&(D)) | ((C) &(A)) | ((D)&(A))) + X[13] + 0x5A827999)>>(32 - (13)))); |
77 | ROUND2(A,B,C,D, 2, 3)A = (((A + (((B)&(C)) | ((B)&(D)) | ((C)&(D))) + X [2] + 0x5A827999)<<(3)) | ((A + (((B)&(C)) | ((B)& (D)) | ((C)&(D))) + X[2] + 0x5A827999)>>(32 -(3)))); ROUND2(D,A,B,C, 6, 5)D = (((D + (((A)&(B)) | ((A)&(C)) | ((B)&(C))) + X [6] + 0x5A827999)<<(5)) | ((D + (((A)&(B)) | ((A)& (C)) | ((B)&(C))) + X[6] + 0x5A827999)>>(32 -(5)))); |
78 | ROUND2(C,D,A,B, 10, 9)C = (((C + (((D)&(A)) | ((D)&(B)) | ((A)&(B))) + X [10] + 0x5A827999)<<(9)) | ((C + (((D)&(A)) | ((D)& (B)) | ((A)&(B))) + X[10] + 0x5A827999)>>(32 -(9))) ); ROUND2(B,C,D,A, 14, 13)B = (((B + (((C)&(D)) | ((C)&(A)) | ((D)&(A))) + X [14] + 0x5A827999)<<(13)) | ((B + (((C)&(D)) | ((C) &(A)) | ((D)&(A))) + X[14] + 0x5A827999)>>(32 - (13)))); |
79 | ROUND2(A,B,C,D, 3, 3)A = (((A + (((B)&(C)) | ((B)&(D)) | ((C)&(D))) + X [3] + 0x5A827999)<<(3)) | ((A + (((B)&(C)) | ((B)& (D)) | ((C)&(D))) + X[3] + 0x5A827999)>>(32 -(3)))); ROUND2(D,A,B,C, 7, 5)D = (((D + (((A)&(B)) | ((A)&(C)) | ((B)&(C))) + X [7] + 0x5A827999)<<(5)) | ((D + (((A)&(B)) | ((A)& (C)) | ((B)&(C))) + X[7] + 0x5A827999)>>(32 -(5)))); |
80 | ROUND2(C,D,A,B, 11, 9)C = (((C + (((D)&(A)) | ((D)&(B)) | ((A)&(B))) + X [11] + 0x5A827999)<<(9)) | ((C + (((D)&(A)) | ((D)& (B)) | ((A)&(B))) + X[11] + 0x5A827999)>>(32 -(9))) ); ROUND2(B,C,D,A, 15, 13)B = (((B + (((C)&(D)) | ((C)&(A)) | ((D)&(A))) + X [15] + 0x5A827999)<<(13)) | ((B + (((C)&(D)) | ((C) &(A)) | ((D)&(A))) + X[15] + 0x5A827999)>>(32 - (13)))); |
81 | |
82 | ROUND3(A,B,C,D, 0, 3)A = (((A + ((B)^(C)^(D)) + X[0] + 0x6ED9EBA1)<<(3)) | ( (A + ((B)^(C)^(D)) + X[0] + 0x6ED9EBA1)>>(32 -(3)))); ROUND3(D,A,B,C, 8, 9)D = (((D + ((A)^(B)^(C)) + X[8] + 0x6ED9EBA1)<<(9)) | ( (D + ((A)^(B)^(C)) + X[8] + 0x6ED9EBA1)>>(32 -(9)))); |
83 | ROUND3(C,D,A,B, 4, 11)C = (((C + ((D)^(A)^(B)) + X[4] + 0x6ED9EBA1)<<(11)) | ( (C + ((D)^(A)^(B)) + X[4] + 0x6ED9EBA1)>>(32 -(11)))); ROUND3(B,C,D,A, 12, 15)B = (((B + ((C)^(D)^(A)) + X[12] + 0x6ED9EBA1)<<(15)) | ((B + ((C)^(D)^(A)) + X[12] + 0x6ED9EBA1)>>(32 -(15))) ); |
84 | ROUND3(A,B,C,D, 2, 3)A = (((A + ((B)^(C)^(D)) + X[2] + 0x6ED9EBA1)<<(3)) | ( (A + ((B)^(C)^(D)) + X[2] + 0x6ED9EBA1)>>(32 -(3)))); ROUND3(D,A,B,C, 10, 9)D = (((D + ((A)^(B)^(C)) + X[10] + 0x6ED9EBA1)<<(9)) | ( (D + ((A)^(B)^(C)) + X[10] + 0x6ED9EBA1)>>(32 -(9)))); |
85 | ROUND3(C,D,A,B, 6, 11)C = (((C + ((D)^(A)^(B)) + X[6] + 0x6ED9EBA1)<<(11)) | ( (C + ((D)^(A)^(B)) + X[6] + 0x6ED9EBA1)>>(32 -(11)))); ROUND3(B,C,D,A, 14, 15)B = (((B + ((C)^(D)^(A)) + X[14] + 0x6ED9EBA1)<<(15)) | ((B + ((C)^(D)^(A)) + X[14] + 0x6ED9EBA1)>>(32 -(15))) ); |
86 | ROUND3(A,B,C,D, 1, 3)A = (((A + ((B)^(C)^(D)) + X[1] + 0x6ED9EBA1)<<(3)) | ( (A + ((B)^(C)^(D)) + X[1] + 0x6ED9EBA1)>>(32 -(3)))); ROUND3(D,A,B,C, 9, 9)D = (((D + ((A)^(B)^(C)) + X[9] + 0x6ED9EBA1)<<(9)) | ( (D + ((A)^(B)^(C)) + X[9] + 0x6ED9EBA1)>>(32 -(9)))); |
87 | ROUND3(C,D,A,B, 5, 11)C = (((C + ((D)^(A)^(B)) + X[5] + 0x6ED9EBA1)<<(11)) | ( (C + ((D)^(A)^(B)) + X[5] + 0x6ED9EBA1)>>(32 -(11)))); ROUND3(B,C,D,A, 13, 15)B = (((B + ((C)^(D)^(A)) + X[13] + 0x6ED9EBA1)<<(15)) | ((B + ((C)^(D)^(A)) + X[13] + 0x6ED9EBA1)>>(32 -(15))) ); |
88 | ROUND3(A,B,C,D, 3, 3)A = (((A + ((B)^(C)^(D)) + X[3] + 0x6ED9EBA1)<<(3)) | ( (A + ((B)^(C)^(D)) + X[3] + 0x6ED9EBA1)>>(32 -(3)))); ROUND3(D,A,B,C, 11, 9)D = (((D + ((A)^(B)^(C)) + X[11] + 0x6ED9EBA1)<<(9)) | ( (D + ((A)^(B)^(C)) + X[11] + 0x6ED9EBA1)>>(32 -(9)))); |
89 | ROUND3(C,D,A,B, 7, 11)C = (((C + ((D)^(A)^(B)) + X[7] + 0x6ED9EBA1)<<(11)) | ( (C + ((D)^(A)^(B)) + X[7] + 0x6ED9EBA1)>>(32 -(11)))); ROUND3(B,C,D,A, 15, 15)B = (((B + ((C)^(D)^(A)) + X[15] + 0x6ED9EBA1)<<(15)) | ((B + ((C)^(D)^(A)) + X[15] + 0x6ED9EBA1)>>(32 -(15))) ); |
90 | |
91 | A += AA; B += BB; C += CC; D += DD; |
92 | |
93 | #ifdef LARGE_INT32 |
94 | A &= 0xFFFFFFFF; B &= 0xFFFFFFFF; |
95 | C &= 0xFFFFFFFF; D &= 0xFFFFFFFF; |
96 | #endif |
97 | |
98 | for (j = 0; j < 16; j++) |
99 | X[j] = 0; |
100 | |
101 | m->A = A; m->B = B; m->C = C; m->D = D; |
102 | } |
103 | |
104 | static void copy64 (uint32_t *M, const unsigned char *in) |
105 | { |
106 | int i; |
107 | |
108 | for (i = 0; i < 16; i++) |
109 | M[i] = (in[i * 4 + 3] << 24) | (in[i * 4 + 2] << 16) | (in[i * 4 + 1] << 8) | (in[i * 4 + 0] << 0); |
110 | } |
111 | |
112 | static void copy4 (unsigned char *out, uint32_t x) |
113 | { |
114 | out[0] = x&0xFF; |
115 | out[1] = (x>>8)&0xFF; |
116 | out[2] = (x>>16)&0xFF; |
117 | out[3] = (x>>24)&0xFF; |
118 | } |
119 | |
120 | static void mdfour_begin (struct mdfour *md) |
121 | { |
122 | md->A = 0x67452301; |
123 | md->B = 0xefcdab89; |
124 | md->C = 0x98badcfe; |
125 | md->D = 0x10325476; |
126 | md->totalN = 0; |
127 | } |
128 | |
129 | |
130 | static void mdfour_tail (const unsigned char *in, int n) |
131 | { |
132 | unsigned char buf[128]; |
133 | uint32_t M[16]; |
134 | uint32_t b; |
135 | |
136 | m->totalN += n; |
137 | |
138 | b = m->totalN * 8; |
139 | |
140 | OBJZERO(buf)(memset(&((buf)), (0), sizeof((buf)))); |
141 | if (n) |
142 | memcpy(buf, in, n); |
143 | buf[n] = 0x80; |
144 | |
145 | if (n <= 55) { |
146 | copy4(buf + 56, b); |
147 | copy64(M, buf); |
148 | mdfour64(M); |
149 | } else { |
150 | copy4(buf + 120, b); |
151 | copy64(M, buf); |
152 | mdfour64(M); |
153 | copy64(M, buf + 64); |
154 | mdfour64(M); |
155 | } |
156 | } |
157 | |
158 | static void mdfour_update (struct mdfour *md, const unsigned char *in, int n) |
159 | { |
160 | uint32_t M[16]; |
161 | |
162 | /** start of edit by Forest 'LordHavoc' Hale |
163 | * commented out to prevent crashing when length is 0 |
164 | * if (n == 0) mdfour_tail(in, n); |
165 | * end of edit by Forest 'LordHavoc' Hale |
166 | */ |
167 | |
168 | m = md; |
169 | |
170 | while (n >= 64) { |
171 | copy64(M, in); |
172 | mdfour64(M); |
173 | in += 64; |
174 | n -= 64; |
175 | m->totalN += 64; |
176 | } |
177 | |
178 | mdfour_tail(in, n); |
179 | } |
180 | |
181 | |
182 | static void mdfour_result (struct mdfour *md, unsigned char *out) |
183 | { |
184 | m = md; |
185 | |
186 | copy4(out, m->A); |
187 | copy4(out + 4, m->B); |
188 | copy4(out + 8, m->C); |
189 | copy4(out + 12, m->D); |
190 | } |
191 | |
192 | |
193 | static void mdfour (unsigned char *out, const unsigned char *in, int n) |
194 | { |
195 | struct mdfour md; |
196 | mdfour_begin(&md); |
197 | mdfour_update(&md, in, n); |
198 | mdfour_result(&md, out); |
199 | } |
Address of stack memory associated with local variable 'md' is still referred to by the global variable 'm' upon returning to the caller. This will be a dangling reference | |
200 | |
201 | /** |
202 | * MD4-based checksum utility functions |
203 | * Copyright (C) 2000 Jeff Teunissen <d2deek@pmail.net> |
204 | * Author: Jeff Teunissen <d2deek@pmail.net> |
205 | * Date: 01 Jan 2000 |
206 | */ |
207 | |
208 | unsigned Com_BlockChecksum (const void *buffer, int length) |
209 | { |
210 | int digest[4]; |
211 | unsigned val; |
212 | |
213 | mdfour((unsigned char *) digest, (const unsigned char *) buffer, length); |
214 | |
215 | val = digest[0] ^ digest[1] ^ digest[2] ^ digest[3]; |
216 | |
217 | return val; |
218 | } |