Keepassxc / zxcvbn-c One byte stack buffer overflow
Posted on 30 November -0001
<HTML><HEAD><TITLE>keepassxc / zxcvbn-c One byte stack buffer overflow</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>Hi, I recently reported a one byte buffer overflow in keepassxc [1] [2]. It's a pretty typical C bug: An array supposed to hold a string of a certain size plus a trailing zero byte is one byte too small (i.e. the size doesn't consider the trailing zero). Given that the overflow happens right at the application's startup I doubt it's exploitable in a meaningful way. The bug was discovered simply by compiling with asan and running keepassxc. The code comes from zxcvbn-c (a checker for password quality), where I've also reported it [3] (together with another minor bug regarding a misuse of new [] / delete). keepassxc is a fork of keepassx. However keepassx is not affected, as it doesn't contain the zxcvbn password quality checking code. One takeaway of this is that even amongst developers of security tools the use of address sanitizer is still not a standard practice everyone's using to test their C code. [1] https://github.com/keepassxreboot/keepassxc/pull/363 [2] https://github.com/keepassxreboot/keepassxc/pull/365 [3] https://github.com/tsyrogit/zxcvbn-c/pull/11 -- Hanno Böck https://hboeck.de/</BODY></HTML>
