Bug Summary

File:common/md4.cpp
Location:line 199, column 1
Description:Address of stack memory associated with local variable 'md' is still referred to by the global variable 'm' upon returning to the caller. This will be a dangling reference

Annotated Source Code

1/**
2 * @file
3 * @brief An implementation of MD4 designed for use in the samba SMB authentication protocol
4 * @note This code makes no attempt to be fast!
5 * @note It assumes that a int is at least 32 bits long
6 */
7
8/*
9 Copyright (C) 1997-1998 Andrew Tridgell
10
11 This program is free software; you can redistribute it and/or
12 modify it under the terms of the GNU General Public License
13 as published by the Free Software Foundation; either version 2
14 of the License, or (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
19
20 See the GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program; if not, write to:
24
25 Free Software Foundation, Inc.
26 59 Temple Place - Suite 330
27 Boston, MA 02111-1307, USA
28
29 $Id$
30*/
31
32#include "../shared/shared.h"
33#include "md4.h"
34
35static struct mdfour *m;
36
37#define F(X,Y,Z)(((X)&(Y)) | ((~(X))&(Z))) (((X)&(Y)) | ((~(X))&(Z)))
38#define G(X,Y,Z)(((X)&(Y)) | ((X)&(Z)) | ((Y)&(Z))) (((X)&(Y)) | ((X)&(Z)) | ((Y)&(Z)))
39#define H(X,Y,Z)((X)^(Y)^(Z)) ((X)^(Y)^(Z))
40#ifdef LARGE_INT32
41#define lshift(x,s)(((x)<<(s)) | ((x)>>(32 -(s)))) ((((x)<<(s))&0xFFFFFFFF) | (((x)>>(32-(s)))&0xFFFFFFFF))
42#else
43#define lshift(x,s)(((x)<<(s)) | ((x)>>(32 -(s)))) (((x)<<(s)) | ((x)>>(32-(s))))
44#endif
45
46#define ROUND1(a,b,c,d,k,s)a = (((a + (((b)&(c)) | ((~(b))&(d))) + X[k])<<
(s)) | ((a + (((b)&(c)) | ((~(b))&(d))) + X[k])>>
(32 -(s))))
a = lshift(a + F(b,c,d) + X[k], s)(((a + (((b)&(c)) | ((~(b))&(d))) + X[k])<<(s))
| ((a + (((b)&(c)) | ((~(b))&(d))) + X[k])>>(32
-(s))))
47#define ROUND2(a,b,c,d,k,s)a = (((a + (((b)&(c)) | ((b)&(d)) | ((c)&(d))) + X
[k] + 0x5A827999)<<(s)) | ((a + (((b)&(c)) | ((b)&
(d)) | ((c)&(d))) + X[k] + 0x5A827999)>>(32 -(s))))
a = lshift(a + G(b,c,d) + X[k] + 0x5A827999,s)(((a + (((b)&(c)) | ((b)&(d)) | ((c)&(d))) + X[k]
+ 0x5A827999)<<(s)) | ((a + (((b)&(c)) | ((b)&
(d)) | ((c)&(d))) + X[k] + 0x5A827999)>>(32 -(s))))
48#define ROUND3(a,b,c,d,k,s)a = (((a + ((b)^(c)^(d)) + X[k] + 0x6ED9EBA1)<<(s)) | (
(a + ((b)^(c)^(d)) + X[k] + 0x6ED9EBA1)>>(32 -(s))))
a = lshift(a + H(b,c,d) + X[k] + 0x6ED9EBA1,s)(((a + ((b)^(c)^(d)) + X[k] + 0x6ED9EBA1)<<(s)) | ((a +
((b)^(c)^(d)) + X[k] + 0x6ED9EBA1)>>(32 -(s))))
49
50/* this applies md4 to 64 byte chunks */
51static void mdfour64 (uint32_t *M)
52{
53 int j;
54 uint32_t AA, BB, CC, DD;
55 uint32_t X[16];
56 uint32_t A, B, C, D;
57
58 for (j = 0; j < 16; j++)
59 X[j] = M[j];
60
61 A = m->A; B = m->B; C = m->C; D = m->D;
62 AA = A; BB = B; CC = C; DD = D;
63
64 ROUND1(A,B,C,D, 0, 3)A = (((A + (((B)&(C)) | ((~(B))&(D))) + X[0])<<
(3)) | ((A + (((B)&(C)) | ((~(B))&(D))) + X[0])>>
(32 -(3))))
; ROUND1(D,A,B,C, 1, 7)D = (((D + (((A)&(B)) | ((~(A))&(C))) + X[1])<<
(7)) | ((D + (((A)&(B)) | ((~(A))&(C))) + X[1])>>
(32 -(7))))
;
65 ROUND1(C,D,A,B, 2, 11)C = (((C + (((D)&(A)) | ((~(D))&(B))) + X[2])<<
(11)) | ((C + (((D)&(A)) | ((~(D))&(B))) + X[2])>>
(32 -(11))))
; ROUND1(B,C,D,A, 3, 19)B = (((B + (((C)&(D)) | ((~(C))&(A))) + X[3])<<
(19)) | ((B + (((C)&(D)) | ((~(C))&(A))) + X[3])>>
(32 -(19))))
;
66 ROUND1(A,B,C,D, 4, 3)A = (((A + (((B)&(C)) | ((~(B))&(D))) + X[4])<<
(3)) | ((A + (((B)&(C)) | ((~(B))&(D))) + X[4])>>
(32 -(3))))
; ROUND1(D,A,B,C, 5, 7)D = (((D + (((A)&(B)) | ((~(A))&(C))) + X[5])<<
(7)) | ((D + (((A)&(B)) | ((~(A))&(C))) + X[5])>>
(32 -(7))))
;
67 ROUND1(C,D,A,B, 6, 11)C = (((C + (((D)&(A)) | ((~(D))&(B))) + X[6])<<
(11)) | ((C + (((D)&(A)) | ((~(D))&(B))) + X[6])>>
(32 -(11))))
; ROUND1(B,C,D,A, 7, 19)B = (((B + (((C)&(D)) | ((~(C))&(A))) + X[7])<<
(19)) | ((B + (((C)&(D)) | ((~(C))&(A))) + X[7])>>
(32 -(19))))
;
68 ROUND1(A,B,C,D, 8, 3)A = (((A + (((B)&(C)) | ((~(B))&(D))) + X[8])<<
(3)) | ((A + (((B)&(C)) | ((~(B))&(D))) + X[8])>>
(32 -(3))))
; ROUND1(D,A,B,C, 9, 7)D = (((D + (((A)&(B)) | ((~(A))&(C))) + X[9])<<
(7)) | ((D + (((A)&(B)) | ((~(A))&(C))) + X[9])>>
(32 -(7))))
;
69 ROUND1(C,D,A,B, 10, 11)C = (((C + (((D)&(A)) | ((~(D))&(B))) + X[10])<<
(11)) | ((C + (((D)&(A)) | ((~(D))&(B))) + X[10])>>
(32 -(11))))
; ROUND1(B,C,D,A, 11, 19)B = (((B + (((C)&(D)) | ((~(C))&(A))) + X[11])<<
(19)) | ((B + (((C)&(D)) | ((~(C))&(A))) + X[11])>>
(32 -(19))))
;
70 ROUND1(A,B,C,D, 12, 3)A = (((A + (((B)&(C)) | ((~(B))&(D))) + X[12])<<
(3)) | ((A + (((B)&(C)) | ((~(B))&(D))) + X[12])>>
(32 -(3))))
; ROUND1(D,A,B,C, 13, 7)D = (((D + (((A)&(B)) | ((~(A))&(C))) + X[13])<<
(7)) | ((D + (((A)&(B)) | ((~(A))&(C))) + X[13])>>
(32 -(7))))
;
71 ROUND1(C,D,A,B, 14, 11)C = (((C + (((D)&(A)) | ((~(D))&(B))) + X[14])<<
(11)) | ((C + (((D)&(A)) | ((~(D))&(B))) + X[14])>>
(32 -(11))))
; ROUND1(B,C,D,A, 15, 19)B = (((B + (((C)&(D)) | ((~(C))&(A))) + X[15])<<
(19)) | ((B + (((C)&(D)) | ((~(C))&(A))) + X[15])>>
(32 -(19))))
;
72
73 ROUND2(A,B,C,D, 0, 3)A = (((A + (((B)&(C)) | ((B)&(D)) | ((C)&(D))) + X
[0] + 0x5A827999)<<(3)) | ((A + (((B)&(C)) | ((B)&
(D)) | ((C)&(D))) + X[0] + 0x5A827999)>>(32 -(3))))
; ROUND2(D,A,B,C, 4, 5)D = (((D + (((A)&(B)) | ((A)&(C)) | ((B)&(C))) + X
[4] + 0x5A827999)<<(5)) | ((D + (((A)&(B)) | ((A)&
(C)) | ((B)&(C))) + X[4] + 0x5A827999)>>(32 -(5))))
;
74 ROUND2(C,D,A,B, 8, 9)C = (((C + (((D)&(A)) | ((D)&(B)) | ((A)&(B))) + X
[8] + 0x5A827999)<<(9)) | ((C + (((D)&(A)) | ((D)&
(B)) | ((A)&(B))) + X[8] + 0x5A827999)>>(32 -(9))))
; ROUND2(B,C,D,A, 12, 13)B = (((B + (((C)&(D)) | ((C)&(A)) | ((D)&(A))) + X
[12] + 0x5A827999)<<(13)) | ((B + (((C)&(D)) | ((C)
&(A)) | ((D)&(A))) + X[12] + 0x5A827999)>>(32 -
(13))))
;
75 ROUND2(A,B,C,D, 1, 3)A = (((A + (((B)&(C)) | ((B)&(D)) | ((C)&(D))) + X
[1] + 0x5A827999)<<(3)) | ((A + (((B)&(C)) | ((B)&
(D)) | ((C)&(D))) + X[1] + 0x5A827999)>>(32 -(3))))
; ROUND2(D,A,B,C, 5, 5)D = (((D + (((A)&(B)) | ((A)&(C)) | ((B)&(C))) + X
[5] + 0x5A827999)<<(5)) | ((D + (((A)&(B)) | ((A)&
(C)) | ((B)&(C))) + X[5] + 0x5A827999)>>(32 -(5))))
;
76 ROUND2(C,D,A,B, 9, 9)C = (((C + (((D)&(A)) | ((D)&(B)) | ((A)&(B))) + X
[9] + 0x5A827999)<<(9)) | ((C + (((D)&(A)) | ((D)&
(B)) | ((A)&(B))) + X[9] + 0x5A827999)>>(32 -(9))))
; ROUND2(B,C,D,A, 13, 13)B = (((B + (((C)&(D)) | ((C)&(A)) | ((D)&(A))) + X
[13] + 0x5A827999)<<(13)) | ((B + (((C)&(D)) | ((C)
&(A)) | ((D)&(A))) + X[13] + 0x5A827999)>>(32 -
(13))))
;
77 ROUND2(A,B,C,D, 2, 3)A = (((A + (((B)&(C)) | ((B)&(D)) | ((C)&(D))) + X
[2] + 0x5A827999)<<(3)) | ((A + (((B)&(C)) | ((B)&
(D)) | ((C)&(D))) + X[2] + 0x5A827999)>>(32 -(3))))
; ROUND2(D,A,B,C, 6, 5)D = (((D + (((A)&(B)) | ((A)&(C)) | ((B)&(C))) + X
[6] + 0x5A827999)<<(5)) | ((D + (((A)&(B)) | ((A)&
(C)) | ((B)&(C))) + X[6] + 0x5A827999)>>(32 -(5))))
;
78 ROUND2(C,D,A,B, 10, 9)C = (((C + (((D)&(A)) | ((D)&(B)) | ((A)&(B))) + X
[10] + 0x5A827999)<<(9)) | ((C + (((D)&(A)) | ((D)&
(B)) | ((A)&(B))) + X[10] + 0x5A827999)>>(32 -(9)))
)
; ROUND2(B,C,D,A, 14, 13)B = (((B + (((C)&(D)) | ((C)&(A)) | ((D)&(A))) + X
[14] + 0x5A827999)<<(13)) | ((B + (((C)&(D)) | ((C)
&(A)) | ((D)&(A))) + X[14] + 0x5A827999)>>(32 -
(13))))
;
79 ROUND2(A,B,C,D, 3, 3)A = (((A + (((B)&(C)) | ((B)&(D)) | ((C)&(D))) + X
[3] + 0x5A827999)<<(3)) | ((A + (((B)&(C)) | ((B)&
(D)) | ((C)&(D))) + X[3] + 0x5A827999)>>(32 -(3))))
; ROUND2(D,A,B,C, 7, 5)D = (((D + (((A)&(B)) | ((A)&(C)) | ((B)&(C))) + X
[7] + 0x5A827999)<<(5)) | ((D + (((A)&(B)) | ((A)&
(C)) | ((B)&(C))) + X[7] + 0x5A827999)>>(32 -(5))))
;
80 ROUND2(C,D,A,B, 11, 9)C = (((C + (((D)&(A)) | ((D)&(B)) | ((A)&(B))) + X
[11] + 0x5A827999)<<(9)) | ((C + (((D)&(A)) | ((D)&
(B)) | ((A)&(B))) + X[11] + 0x5A827999)>>(32 -(9)))
)
; ROUND2(B,C,D,A, 15, 13)B = (((B + (((C)&(D)) | ((C)&(A)) | ((D)&(A))) + X
[15] + 0x5A827999)<<(13)) | ((B + (((C)&(D)) | ((C)
&(A)) | ((D)&(A))) + X[15] + 0x5A827999)>>(32 -
(13))))
;
81
82 ROUND3(A,B,C,D, 0, 3)A = (((A + ((B)^(C)^(D)) + X[0] + 0x6ED9EBA1)<<(3)) | (
(A + ((B)^(C)^(D)) + X[0] + 0x6ED9EBA1)>>(32 -(3))))
; ROUND3(D,A,B,C, 8, 9)D = (((D + ((A)^(B)^(C)) + X[8] + 0x6ED9EBA1)<<(9)) | (
(D + ((A)^(B)^(C)) + X[8] + 0x6ED9EBA1)>>(32 -(9))))
;
83 ROUND3(C,D,A,B, 4, 11)C = (((C + ((D)^(A)^(B)) + X[4] + 0x6ED9EBA1)<<(11)) | (
(C + ((D)^(A)^(B)) + X[4] + 0x6ED9EBA1)>>(32 -(11))))
; ROUND3(B,C,D,A, 12, 15)B = (((B + ((C)^(D)^(A)) + X[12] + 0x6ED9EBA1)<<(15)) |
((B + ((C)^(D)^(A)) + X[12] + 0x6ED9EBA1)>>(32 -(15)))
)
;
84 ROUND3(A,B,C,D, 2, 3)A = (((A + ((B)^(C)^(D)) + X[2] + 0x6ED9EBA1)<<(3)) | (
(A + ((B)^(C)^(D)) + X[2] + 0x6ED9EBA1)>>(32 -(3))))
; ROUND3(D,A,B,C, 10, 9)D = (((D + ((A)^(B)^(C)) + X[10] + 0x6ED9EBA1)<<(9)) | (
(D + ((A)^(B)^(C)) + X[10] + 0x6ED9EBA1)>>(32 -(9))))
;
85 ROUND3(C,D,A,B, 6, 11)C = (((C + ((D)^(A)^(B)) + X[6] + 0x6ED9EBA1)<<(11)) | (
(C + ((D)^(A)^(B)) + X[6] + 0x6ED9EBA1)>>(32 -(11))))
; ROUND3(B,C,D,A, 14, 15)B = (((B + ((C)^(D)^(A)) + X[14] + 0x6ED9EBA1)<<(15)) |
((B + ((C)^(D)^(A)) + X[14] + 0x6ED9EBA1)>>(32 -(15)))
)
;
86 ROUND3(A,B,C,D, 1, 3)A = (((A + ((B)^(C)^(D)) + X[1] + 0x6ED9EBA1)<<(3)) | (
(A + ((B)^(C)^(D)) + X[1] + 0x6ED9EBA1)>>(32 -(3))))
; ROUND3(D,A,B,C, 9, 9)D = (((D + ((A)^(B)^(C)) + X[9] + 0x6ED9EBA1)<<(9)) | (
(D + ((A)^(B)^(C)) + X[9] + 0x6ED9EBA1)>>(32 -(9))))
;
87 ROUND3(C,D,A,B, 5, 11)C = (((C + ((D)^(A)^(B)) + X[5] + 0x6ED9EBA1)<<(11)) | (
(C + ((D)^(A)^(B)) + X[5] + 0x6ED9EBA1)>>(32 -(11))))
; ROUND3(B,C,D,A, 13, 15)B = (((B + ((C)^(D)^(A)) + X[13] + 0x6ED9EBA1)<<(15)) |
((B + ((C)^(D)^(A)) + X[13] + 0x6ED9EBA1)>>(32 -(15)))
)
;
88 ROUND3(A,B,C,D, 3, 3)A = (((A + ((B)^(C)^(D)) + X[3] + 0x6ED9EBA1)<<(3)) | (
(A + ((B)^(C)^(D)) + X[3] + 0x6ED9EBA1)>>(32 -(3))))
; ROUND3(D,A,B,C, 11, 9)D = (((D + ((A)^(B)^(C)) + X[11] + 0x6ED9EBA1)<<(9)) | (
(D + ((A)^(B)^(C)) + X[11] + 0x6ED9EBA1)>>(32 -(9))))
;
89 ROUND3(C,D,A,B, 7, 11)C = (((C + ((D)^(A)^(B)) + X[7] + 0x6ED9EBA1)<<(11)) | (
(C + ((D)^(A)^(B)) + X[7] + 0x6ED9EBA1)>>(32 -(11))))
; ROUND3(B,C,D,A, 15, 15)B = (((B + ((C)^(D)^(A)) + X[15] + 0x6ED9EBA1)<<(15)) |
((B + ((C)^(D)^(A)) + X[15] + 0x6ED9EBA1)>>(32 -(15)))
)
;
90
91 A += AA; B += BB; C += CC; D += DD;
92
93#ifdef LARGE_INT32
94 A &= 0xFFFFFFFF; B &= 0xFFFFFFFF;
95 C &= 0xFFFFFFFF; D &= 0xFFFFFFFF;
96#endif
97
98 for (j = 0; j < 16; j++)
99 X[j] = 0;
100
101 m->A = A; m->B = B; m->C = C; m->D = D;
102}
103
104static void copy64 (uint32_t *M, const unsigned char *in)
105{
106 int i;
107
108 for (i = 0; i < 16; i++)
109 M[i] = (in[i * 4 + 3] << 24) | (in[i * 4 + 2] << 16) | (in[i * 4 + 1] << 8) | (in[i * 4 + 0] << 0);
110}
111
112static void copy4 (unsigned char *out, uint32_t x)
113{
114 out[0] = x&0xFF;
115 out[1] = (x>>8)&0xFF;
116 out[2] = (x>>16)&0xFF;
117 out[3] = (x>>24)&0xFF;
118}
119
120static void mdfour_begin (struct mdfour *md)
121{
122 md->A = 0x67452301;
123 md->B = 0xefcdab89;
124 md->C = 0x98badcfe;
125 md->D = 0x10325476;
126 md->totalN = 0;
127}
128
129
130static void mdfour_tail (const unsigned char *in, int n)
131{
132 unsigned char buf[128];
133 uint32_t M[16];
134 uint32_t b;
135
136 m->totalN += n;
137
138 b = m->totalN * 8;
139
140 OBJZERO(buf)(memset(&((buf)), (0), sizeof((buf))));
141 if (n)
142 memcpy(buf, in, n);
143 buf[n] = 0x80;
144
145 if (n <= 55) {
146 copy4(buf + 56, b);
147 copy64(M, buf);
148 mdfour64(M);
149 } else {
150 copy4(buf + 120, b);
151 copy64(M, buf);
152 mdfour64(M);
153 copy64(M, buf + 64);
154 mdfour64(M);
155 }
156}
157
158static void mdfour_update (struct mdfour *md, const unsigned char *in, int n)
159{
160 uint32_t M[16];
161
162 /** start of edit by Forest 'LordHavoc' Hale
163 * commented out to prevent crashing when length is 0
164 * if (n == 0) mdfour_tail(in, n);
165 * end of edit by Forest 'LordHavoc' Hale
166 */
167
168 m = md;
169
170 while (n >= 64) {
171 copy64(M, in);
172 mdfour64(M);
173 in += 64;
174 n -= 64;
175 m->totalN += 64;
176 }
177
178 mdfour_tail(in, n);
179}
180
181
182static void mdfour_result (struct mdfour *md, unsigned char *out)
183{
184 m = md;
185
186 copy4(out, m->A);
187 copy4(out + 4, m->B);
188 copy4(out + 8, m->C);
189 copy4(out + 12, m->D);
190}
191
192
193static void mdfour (unsigned char *out, const unsigned char *in, int n)
194{
195 struct mdfour md;
196 mdfour_begin(&md);
197 mdfour_update(&md, in, n);
198 mdfour_result(&md, out);
199}
Address of stack memory associated with local variable 'md' is still referred to by the global variable 'm' upon returning to the caller. This will be a dangling reference
200
201/**
202 * MD4-based checksum utility functions
203 * Copyright (C) 2000 Jeff Teunissen <d2deek@pmail.net>
204 * Author: Jeff Teunissen <d2deek@pmail.net>
205 * Date: 01 Jan 2000
206 */
207
208unsigned Com_BlockChecksum (const void *buffer, int length)
209{
210 int digest[4];
211 unsigned val;
212
213 mdfour((unsigned char *) digest, (const unsigned char *) buffer, length);
214
215 val = digest[0] ^ digest[1] ^ digest[2] ^ digest[3];
216
217 return val;
218}