Solar Designer

> This happens after the merge, running LM or NT hashes with single mode: Also triggerable in wordlist mode using `--rules=single`.

Reduced the test case to single-line wordlist and `--rules=': T[12]'`. Somehow the T command is reached 3 times before crash, first two have `pos` as 1 and 2, and the...

This must be related to: ```c #define INVALID_LENGTH 0x81 #define INFINITE_LENGTH 0xFF ``` Indeed I overlooked these and they need to be updated, but I am yet to figure out...

Now that I look closer, there are many places in `rules.c` that assume lengths fit in a `char` or `unsigned char`. The hardest to fix may be the `v` command,...

Looks like we also had deliberate wraparound for the `m` position code, which means `length - 1`, when the length is 0. This essentially became `INFINITE_LENGTH`, which fit our double-sized...

> deliberate wraparound for the `m` position code, which means `length - 1`, when the length is 0. I see no free way to emulate this now. (I already did,...

This works: ```diff - rules_apply(safe_null_string, out_rule, split); + rules_apply(out_rule, out_rule, split); ``` but it may be too much of a hack as `memory` and the value of `m` may become...

> > deliberate wraparound for the `m` position code, which means `length - 1`, when the length is 0. > > I see no free way to emulate this now....

Wrapping negative lengths to infinity is weird for some commands, e.g. inserts, but I've just tested that this is behavior we actually had before - e.g. `va04 iaA` tries to...

@magnumripper You introduced this `safe_null_string` in e04c0c8720511655698f5d9e597cb328ca4ffb5f, so perhaps you actually saw problems before. I don't know whether things changed since, or whether I'm just not testing things enough to...