From b2154b7ed9e6840df721a3f125e95b1bdb1d32df Mon Sep 17 00:00:00 2001 From: jsteube Date: Mon, 21 Jan 2019 10:00:44 +0100 Subject: [PATCH] Fix use-after-free of hash_name --- include/status.h | 4 ++-- include/types.h | 4 ++-- src/hashcat.c | 2 +- src/status.c | 14 +++++++++----- src/terminal.c | 4 ++-- 5 files changed, 16 insertions(+), 12 deletions(-) diff --git a/include/status.h b/include/status.h index 48653526d..2f94fa53f 100644 --- a/include/status.h +++ b/include/status.h @@ -35,8 +35,8 @@ double status_get_guess_mod_percent (const hashcat_ctx_t *hash char *status_get_guess_charset (const hashcat_ctx_t *hashcat_ctx); int status_get_guess_mask_length (const hashcat_ctx_t *hashcat_ctx); char *status_get_guess_candidates_dev (const hashcat_ctx_t *hashcat_ctx, const int device_id); -const char *status_get_hash_type (const hashcat_ctx_t *hashcat_ctx); -const char *status_get_hash_target (const hashcat_ctx_t *hashcat_ctx); +char *status_get_hash_name (const hashcat_ctx_t *hashcat_ctx); +char *status_get_hash_target (const hashcat_ctx_t *hashcat_ctx); int status_get_digests_done (const hashcat_ctx_t *hashcat_ctx); int status_get_digests_cnt (const hashcat_ctx_t *hashcat_ctx); double status_get_digests_percent (const hashcat_ctx_t *hashcat_ctx); diff --git a/include/types.h b/include/types.h index 52a2dd4c5..dedd8aaec 100644 --- a/include/types.h +++ b/include/types.h @@ -2056,8 +2056,8 @@ typedef struct device_info typedef struct hashcat_status { - const char *hash_target; - const char *hash_type; + char *hash_target; + char *hash_name; int guess_mode; char *guess_base; int guess_base_offset; diff --git a/src/hashcat.c b/src/hashcat.c index 355ebb957..487eb218d 100644 --- a/src/hashcat.c +++ b/src/hashcat.c @@ -1396,7 +1396,7 @@ int hashcat_get_status (hashcat_ctx_t *hashcat_ctx, hashcat_status_t *hashcat_st hashcat_status->digests_done = status_get_digests_done (hashcat_ctx); hashcat_status->digests_percent = status_get_digests_percent (hashcat_ctx); hashcat_status->hash_target = status_get_hash_target (hashcat_ctx); - hashcat_status->hash_type = status_get_hash_type (hashcat_ctx); + hashcat_status->hash_name = status_get_hash_name (hashcat_ctx); hashcat_status->guess_base = status_get_guess_base (hashcat_ctx); hashcat_status->guess_base_offset = status_get_guess_base_offset (hashcat_ctx); hashcat_status->guess_base_count = status_get_guess_base_count (hashcat_ctx); diff --git a/src/status.c b/src/status.c index c2860ca1e..443681954 100644 --- a/src/status.c +++ b/src/status.c @@ -289,14 +289,14 @@ int status_get_status_number (const hashcat_ctx_t *hashcat_ctx) return status_ctx->devices_status; } -const char *status_get_hash_type (const hashcat_ctx_t *hashcat_ctx) +char *status_get_hash_name (const hashcat_ctx_t *hashcat_ctx) { const hashconfig_t *hashconfig = hashcat_ctx->hashconfig; - return hashconfig->hash_name; + return hcstrdup (hashconfig->hash_name); } -const char *status_get_hash_target (const hashcat_ctx_t *hashcat_ctx) +char *status_get_hash_target (const hashcat_ctx_t *hashcat_ctx) { const hashconfig_t *hashconfig = hashcat_ctx->hashconfig; const hashes_t *hashes = hashcat_ctx->hashes; @@ -324,7 +324,7 @@ const char *status_get_hash_target (const hashcat_ctx_t *hashcat_ctx) { if (hashconfig->opts_type & OPTS_TYPE_BINARY_HASHFILE) { - return hashes->hashfile; + return hcstrdup (hashes->hashfile); } else { @@ -346,7 +346,7 @@ const char *status_get_hash_target (const hashcat_ctx_t *hashcat_ctx) } else { - return hashes->hashfile; + return hcstrdup (hashes->hashfile); } } @@ -2159,6 +2159,8 @@ void status_status_destroy (hashcat_ctx_t *hashcat_ctx, hashcat_status_t *hashca if (status_ctx->accessible == false) return; + hcfree (hashcat_status->hash_target); + hcfree (hashcat_status->hash_name); hcfree (hashcat_status->session); hcfree (hashcat_status->time_estimated_absolute); hcfree (hashcat_status->time_estimated_relative); @@ -2170,6 +2172,8 @@ void status_status_destroy (hashcat_ctx_t *hashcat_ctx, hashcat_status_t *hashca hcfree (hashcat_status->guess_charset); hcfree (hashcat_status->cpt); + hashcat_status->hash_target = NULL; + hashcat_status->hash_name = NULL; hashcat_status->session = NULL; hashcat_status->time_estimated_absolute = NULL; hashcat_status->time_estimated_relative = NULL; diff --git a/src/terminal.c b/src/terminal.c index 0ecae2564..0d7fadd55 100644 --- a/src/terminal.c +++ b/src/terminal.c @@ -933,8 +933,8 @@ void status_display (hashcat_ctx_t *hashcat_ctx) hashcat_status->status_string); event_log_info (hashcat_ctx, - "Hash.Type........: %s", - hashcat_status->hash_type); + "Hash.Name........: %s", + hashcat_status->hash_name); event_log_info (hashcat_ctx, "Hash.Target......: %s",