Bug 193355

Summary: OPIE may not generate passwds from the dictionary correctly
Product: Base System Reporter: Dan Turner <dan.turner>
Component: binAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed Not A Bug    
Severity: Affects Many People CC: ache
Priority: ---    
Version: 10.0-RELEASE   
Hardware: Any   
OS: Any   

Description Dan Turner 2014-09-05 23:18:00 UTC
contrib/opie/libopie/btoe.c contains a dictionary, Wp. Wp is _not_ sorted lexicographically. for instance, "YOU" is immediately before "ABED", line . 

The function wsrch (impl. starts at line 2203) implements a binary search over Wp, using strncmp as the comparison method. The call strncmp uses lexicographic ordering, in which "ABED" is considered to be less than "YOU".

Unfortunately, this dictionary is from RFC 2289 & RFC 1760, and is specified in this order. As such, I don't know how modifying this dictionary order (or the search order) would behave in relation to these standards.

I cannot spot any location where Wp is being sorted prior to being used, but I also have not produced proof-of-concept that fails or returns the wrong value, this code looks suspicious to me though, as I think the pre-conditions of the binary search are being violated.
Comment 1 Andrey A. Chernov freebsd_committer 2014-09-06 01:35:45 UTC
start/end of Wp depends of word length:

    if (l < 4) {
      low = 0;
      high = 570;
    } else {
      low = 571;
      high = 2047;
    }
    if ((v = wsrch(word, low, high)) < 0) {
Comment 2 Dan Turner 2014-09-06 07:56:46 UTC
Thanks for your time :-)

I did ask in irc if I was missing anything so obvious!