Bug 193355

Summary:	OPIE may not generate passwds from the dictionary correctly
Product:	Base System	Reporter:	Dan Turner <dan.turner>
Component:	bin	Assignee:	freebsd-bugs (Nobody) <bugs>
Status:	Closed Not A Bug
Severity:	Affects Many People	CC:	ache
Priority:	---
Version:	10.0-RELEASE
Hardware:	Any
OS:	Any

Description Dan Turner 2014-09-05 23:18:00 UTC

contrib/opie/libopie/btoe.c contains a dictionary, Wp. Wp is _not_ sorted lexicographically. for instance, "YOU" is immediately before "ABED", line . 

The function wsrch (impl. starts at line 2203) implements a binary search over Wp, using strncmp as the comparison method. The call strncmp uses lexicographic ordering, in which "ABED" is considered to be less than "YOU".

Unfortunately, this dictionary is from RFC 2289 & RFC 1760, and is specified in this order. As such, I don't know how modifying this dictionary order (or the search order) would behave in relation to these standards.

I cannot spot any location where Wp is being sorted prior to being used, but I also have not produced proof-of-concept that fails or returns the wrong value, this code looks suspicious to me though, as I think the pre-conditions of the binary search are being violated.

Comment 1 Andrey A. Chernov freebsd_committer

2014-09-06 01:35:45 UTC

start/end of Wp depends of word length:

    if (l < 4) {
      low = 0;
      high = 570;
    } else {
      low = 571;
      high = 2047;
    }
    if ((v = wsrch(word, low, high)) < 0) {

Comment 2 Dan Turner 2014-09-06 07:56:46 UTC

Thanks for your time :-)

I did ask in irc if I was missing anything so obvious!