search

nbutton23 / zxcvbn-go

zxcvbn password complexity algorithm in golang
MIT License
379 stars 49 forks source link

Add fuzzing and fix crashers. #27

Closed stevenjohnstone closed 6 years ago

stevenjohnstone commented 6 years ago

The output of strings.ToLower can have less bytes than the input. There are valid utf8 strings which demonstrate this which could be entered as potential passwords which would cause an out of bounds slice access in the dictionary match code.

Fixed issue in go 1.10 test code for adjcmatrix.go to make sure the tests passed cleanly.

dcormier commented 6 years ago

Hey @nbutton23, it would be nice to get this merged in.

nbutton23 commented 6 years ago

I have some free time coming up later this week and I plan on spending some time looking at this PR and anothers. Plus I want to fix some other things that I know about.

Sorry for how long it took to respond to this.

nbutton23 commented 6 years ago

Should the fuzz/workdir be checked in?

stevenjohnstone commented 6 years ago

It's good to have a fuzz corpus to speed up future runs