SHA-3 Segfault

Purpose

A student showed me this today. The SHA-3 python code crashes on a 64-bit Kali machine with a Segmentation Fault.

The same thing happens on my Mac OS X 64-bit machine.

Demonstrating the Crash

In a Terminal window, execute these commands:
apt-get install python-dev
cd
mkdir sha3
cd sha3
git clone https://github.com/ajakubek/python-sha3.git
cd python-sha3
python setup.py build
python setup.py install
python
from sha3 import sha256
s=sha256()
s.update("")
s.hexdigest()
On a 32-bit Kali (or BackTrack) Linux machine, this calculates the SHA-3 256 bit hash of an empty string, as shown below:

But on a 64-bit Kali Linux 2.0 machine, it causes a segfault.

And on my 64-bit Mac, it crashes as well:

Here's the full text of the Mac OS X error report:


Process:               Python [6314]
Path:                  /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Identifier:            Python
Version:               2.7.10 (2.7.10)
Code Type:             X86-64 (Native)
Parent Process:        bash [5395]
Responsible:           Terminal [4860]
User ID:               501

PlugIn Path:             /Library/Python/2.7/site-packages/sha3.so
PlugIn Identifier:       sha3.so
PlugIn Version:          ??? (0)

Date/Time:             2015-12-01 13:40:15.327 -0800
OS Version:            Mac OS X 10.11 (15A284)
Report Version:        11
Anonymous UUID:        EC3062A6-B95C-B7F7-0DE9-86F50AFD269B

Sleep/Wake UUID:       3E95426F-89F5-458A-B573-467D769AABB3

Time Awake Since Boot: 120000 seconds
Time Since Wake:       360 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x000000010e20e000

VM Regions Near 0x10e20e000:
    __LINKEDIT             000000010e20b000-000000010e20e000 [   12K] r--/rwx SM=COW  /Library/Python/2.7/site-packages/sha3.so
--> VM_ALLOCATE            000000010e20e000-000000010e20f000 [    4K] rw-/rwx SM=ALI  
    MALLOC_TINY            00007fa8aac00000-00007fa8ab000000 [ 4096K] rw-/rwx SM=PRV  

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   sha3.so                       	0x000000010e1faebe KeccakPermutationOnWordsAfterXoring1088bits + 210 (KeccakF-1600-opt64.c:264)
1   sha3.so                       	0x000000010e1e2524 Absorb + 604 (KeccakSponge.c:135)
2   sha3.so                       	0x000000010e1e1bd9 sha_update + 72 (sha3_types.c:188)
3   org.python.python             	0x000000010dd5da0b PyEval_EvalFrameEx + 13400
4   org.python.python             	0x000000010dd5a3c1 PyEval_EvalCodeEx + 1583
5   org.python.python             	0x000000010dd59d8c PyEval_EvalCode + 54
6   org.python.python             	0x000000010dd79a42 0x10dcd7000 + 666178
7   org.python.python             	0x000000010dd7986d PyRun_InteractiveOneFlags + 377
8   org.python.python             	0x000000010dd79366 PyRun_InteractiveLoopFlags + 192
9   org.python.python             	0x000000010dd79210 PyRun_AnyFileExFlags + 60
10  org.python.python             	0x000000010dd8b011 Py_Main + 3137
11  libdyld.dylib                 	0x00007fff89cc55ad start + 1

Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x8480308ee1c54139  rbx: 0x57367a097a746843  rcx: 0x8480308ee1c54139  rdx: 0xe1d46f5ed5542a4d
  rdi: 0x000000010e1d5050  rsi: 0x000000010e20df84  rbp: 0x00007fff51f2b660  rsp: 0x00007fff51f2b5d0
   r8: 0x54495d1d5d93a131   r9: 0xf48834090b0d84ce  r10: 0x7d3ffe1ad38e5088  r11: 0x6a7ff0f0a3ade4b0
  r12: 0x9f67a92a2e9fc90a  r13: 0x5120b3cb4928e4da  r14: 0xd22ffc8026f96c39  r15: 0x28f78942f9751583
  rip: 0x000000010e1faebe  rfl: 0x0000000000010202  cr2: 0x000000010e20e000
  
Logical CPU:     6
Error Code:      0x00000004
Trap Number:     14


Binary Images:
       0x10dcd4000 -        0x10dcd4fff  org.python.python (2.7.10 - 2.7.10) <003335E9-1547-3AAD-9A3B-3A58AB2C4329> /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
       0x10dcd7000 -        0x10ddc8ff7  org.python.python (2.7.10 - 2.7.10) <5A7838D3-24D4-395B-BE96-ADD007C86E55> /System/Library/Frameworks/Python.framework/Versions/2.7/Python
       0x10e193000 -        0x10e194fff  _locale.so (94) <746CF7C3-06B6-397C-98EF-E6A15339A5A0> /System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-dynload/_locale.so
       0x10e1d9000 -        0x10e1daff7  readline.so (94) <2F8DCF20-B2DE-3A87-BFAD-C7D4E1B25ACD> /System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-dynload/readline.so
       0x10e1e1000 -        0x10e209fff +sha3.so (0) <75A71758-090C-36D5-B83B-AC6C0EA99CAD> /Library/Python/2.7/site-packages/sha3.so
    0x7fff65bf8000 -     0x7fff65c2ef5f  dyld (360.14) <DF977301-4A63-32ED-9939-1EE3122D18D4> /usr/lib/dyld
    0x7fff86824000 -     0x7fff8686aff7  libauto.dylib (186) <460B0167-C89B-37EC-823C-52F684B31C26> /usr/lib/libauto.dylib
    0x7fff87396000 -     0x7fff8739effb  libsystem_dnssd.dylib (624.1.2) <DB6AB206-4AD8-369D-BF57-1D246AD60582> /usr/lib/system/libsystem_dnssd.dylib
    0x7fff87495000 -     0x7fff874a6ff7  libsystem_trace.dylib (200) <E26A91EA-AD67-3FA2-A3B6-79A93DCC716E> /usr/lib/system/libsystem_trace.dylib
    0x7fff874c6000 -     0x7fff87553fe7  libsystem_c.dylib (1081.1.3) <A60CE86D-1FF3-32AD-A672-C7597F884529> /usr/lib/system/libsystem_c.dylib
    0x7fff87614000 -     0x7fff8761fff7  libcommonCrypto.dylib (60074) <BD1DCF19-8353-3F6A-AFFA-EBBA29A302A8> /usr/lib/system/libcommonCrypto.dylib
    0x7fff889e4000 -     0x7fff88a0dfff  libxpc.dylib (755.1.19) <3E09C275-A33B-357A-B0AB-A2DDF88EC9D5> /usr/lib/system/libxpc.dylib
    0x7fff89cc2000 -     0x7fff89cc5ffb  libdyld.dylib (360.14) <F9D64D8C-4C33-3D06-B7F8-697F13292894> /usr/lib/system/libdyld.dylib
    0x7fff8aeea000 -     0x7fff8af19fc3  libsystem_m.dylib (3105) <07D50372-30ED-3B03-9FA0-0662BF8F0098> /usr/lib/system/libsystem_m.dylib
    0x7fff8b15b000 -     0x7fff8b188fff  libdispatch.dylib (500.1.5) <6B38497E-9448-3433-9D6B-6223F2A99431> /usr/lib/system/libdispatch.dylib
    0x7fff8b41f000 -     0x7fff8b420ffb  libSystem.B.dylib (1225.1.1) <E48AAE3F-370E-34AE-AECA-4CA28F211479> /usr/lib/libSystem.B.dylib
    0x7fff8c2a2000 -     0x7fff8c2a2ff7  libunc.dylib (29) <D9B0C7B1-8648-3AAC-931C-E7CD362FAA8A> /usr/lib/system/libunc.dylib
    0x7fff8d0b1000 -     0x7fff8d128fc7  libcorecrypto.dylib (334) <4E1B969F-8449-3B21-9880-51AD58E25AA6> /usr/lib/system/libcorecrypto.dylib
    0x7fff8d72b000 -     0x7fff8d77eff7  libc++.1.dylib (120.1) <54190E1B-EE49-3D6D-AC29-2813D7380BA5> /usr/lib/libc++.1.dylib
    0x7fff8d949000 -     0x7fff8d949ff7  libkeymgr.dylib (28) <47080280-8B57-3D75-8A20-9E100864DE27> /usr/lib/system/libkeymgr.dylib
    0x7fff8dc14000 -     0x7fff8dc72fff  libsystem_network.dylib (582.1.4) <14ECA259-D471-3E47-A843-FF0990577893> /usr/lib/system/libsystem_network.dylib
    0x7fff8e522000 -     0x7fff8e522ff7  liblaunch.dylib (755.1.19) <7EC0F297-43CC-3D11-B46B-7E72E372648A> /usr/lib/system/liblaunch.dylib
    0x7fff8f7e8000 -     0x7fff8f7e9ffb  libremovefile.dylib (41) <C7CFF5F2-AFFB-3C8D-BDB4-D66D50E657C0> /usr/lib/system/libremovefile.dylib
    0x7fff901ef000 -     0x7fff901f1ff7  libquarantine.dylib (80) <1693C5FE-EA0A-3122-85EB-7950ECC7435A> /usr/lib/system/libquarantine.dylib
    0x7fff903dd000 -     0x7fff90406ff7  libsystem_info.dylib (476) <65D0643A-C8AE-3E8D-9F6E-E4AD823F16B2> /usr/lib/system/libsystem_info.dylib
    0x7fff9089f000 -     0x7fff908bbff7  libsystem_malloc.dylib (67) <1B57A614-3D60-3F87-876F-7DB4AF38120F> /usr/lib/system/libsystem_malloc.dylib
    0x7fff90987000 -     0x7fff909a5ffb  libedit.3.dylib (43) <744915BA-9B98-3256-8DBB-5C760132623F> /usr/lib/libedit.3.dylib
    0x7fff90c37000 -     0x7fff90c38fff  libDiagnosticMessagesClient.dylib (100) <F2D8CFCC-A00A-3675-9C01-EF0C663F2445> /usr/lib/libDiagnosticMessagesClient.dylib
    0x7fff90f3c000 -     0x7fff90f45ff7  libsystem_pthread.dylib (137.1.1) <1373D0F1-C6CA-364E-A6BA-8BDBD0D34670> /usr/lib/system/libsystem_pthread.dylib
    0x7fff90f46000 -     0x7fff90f77ff7  libncurses.5.4.dylib (46) <766F2188-F523-3FAA-AC1F-49447F09E133> /usr/lib/libncurses.5.4.dylib
    0x7fff90f78000 -     0x7fff90f7fff7  libcompiler_rt.dylib (62) <253B36E5-572D-377D-AE99-A02CE32590E5> /usr/lib/system/libcompiler_rt.dylib
    0x7fff90fb9000 -     0x7fff90fe2fff  libc++abi.dylib (125) <F5027B46-1801-344D-BD51-2E6D188C8900> /usr/lib/libc++abi.dylib
    0x7fff9100e000 -     0x7fff91010ff7  libsystem_configuration.dylib (801.1.1) <EB55C3D8-048D-350E-BF24-0CBD4479D51C> /usr/lib/system/libsystem_configuration.dylib
    0x7fff9157c000 -     0x7fff91789fff  libicucore.A.dylib (551.24) <DEB70F32-DA94-323B-B6D1-03D09C8FB10C> /usr/lib/libicucore.A.dylib
    0x7fff91eb6000 -     0x7fff91ec7fff  libz.1.dylib (60) <43317BEA-ACA2-34C2-AF37-902AA926C83A> /usr/lib/libz.1.dylib
    0x7fff92431000 -     0x7fff92435fff  libcache.dylib (75) <4948E2C8-867F-3E9D-AAE7-2F30F0B345C6> /usr/lib/system/libcache.dylib
    0x7fff92997000 -     0x7fff929abfff  libsystem_coretls.dylib (82) <21EDACF1-D9B3-3086-9821-60EB75E7F965> /usr/lib/system/libsystem_coretls.dylib
    0x7fff9642e000 -     0x7fff968a2ff7  com.apple.CoreFoundation (6.9 - 1253) <A8A44D66-A3B2-3B5D-B75B-EC2DC968F4BD> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
    0x7fff96c95000 -     0x7fff96c9effb  libsystem_notify.dylib (149) <56ABC155-CB99-30A8-A8B1-C204B5615092> /usr/lib/system/libsystem_notify.dylib
    0x7fff97026000 -     0x7fff973896d7  libobjc.A.dylib (680) <7C5FAD04-2C01-3ED6-AA40-78925C12A456> /usr/lib/libobjc.A.dylib
    0x7fff97701000 -     0x7fff97706ff7  libmacho.dylib (875.1) <A9EC23EC-11A0-3B4F-A8AC-B990C8267A6E> /usr/lib/system/libmacho.dylib
    0x7fff985c3000 -     0x7fff985cbfff  libsystem_networkextension.dylib (384.1.2) <4736FCC5-9DBA-31F4-AAC8-CD0A177CF502> /usr/lib/system/libsystem_networkextension.dylib
    0x7fff985cc000 -     0x7fff985cdfff  libsystem_blocks.dylib (65) <1B4F1F10-823E-3781-8162-6884D14DF0D6> /usr/lib/system/libsystem_blocks.dylib
    0x7fff9897f000 -     0x7fff98982fff  libsystem_sandbox.dylib (459.1.8) <2F36D536-482C-39EC-BAFD-72297728F0A4> /usr/lib/system/libsystem_sandbox.dylib
    0x7fff98983000 -     0x7fff98984fff  libsystem_secinit.dylib (20) <932ED582-E80F-39DA-B0FA-F1BC5F1AD2F8> /usr/lib/system/libsystem_secinit.dylib
    0x7fff98994000 -     0x7fff9899cfef  libsystem_platform.dylib (73.1.1) <3F4D2390-E3DE-3C24-A515-95DFAC8671C4> /usr/lib/system/libsystem_platform.dylib
    0x7fff98a7c000 -     0x7fff98a93fff  libsystem_asl.dylib (322) <97D794DA-8CE5-3676-AC5E-364F6D172BDA> /usr/lib/system/libsystem_asl.dylib
    0x7fff98b2d000 -     0x7fff98b32ff3  libunwind.dylib (35.3) <FDA18078-A775-3BAF-A5A6-8A7B75D6AA99> /usr/lib/system/libunwind.dylib
    0x7fff98d6d000 -     0x7fff98d75fff  libcopyfile.dylib (127) <CA2602AB-E8B7-3CD8-A0C5-D86E35FDA09F> /usr/lib/system/libcopyfile.dylib
    0x7fff99876000 -     0x7fff99894fff  libsystem_kernel.dylib (3247.1.106) <7DD242A1-E2BF-39D1-8787-B174046E4F15> /usr/lib/system/libsystem_kernel.dylib
    0x7fff99dd0000 -     0x7fff99dd2fff  libsystem_coreservices.dylib (19) <692631A0-1923-32CA-9BD5-044B1382FFDE> /usr/lib/system/libsystem_coreservices.dylib

External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 52243
    thread_create: 0
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=103.2M resident=0K(0%) swapped_out_or_unallocated=103.2M(100%)
Writable regions: Total=39.9M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=39.9M(100%)
 
                                VIRTUAL   REGION 
REGION TYPE                        SIZE    COUNT (non-coalesced) 
===========                     =======  ======= 
Activity Tracing                  2048K        2 
Kernel Alloc Once                    4K        2 
MALLOC                            28.4M        9 
MALLOC guard page                   16K        4 
STACK GUARD                       56.0M        2 
Stack                             8192K        2 
VM_ALLOCATE                       1284K        5 
__DATA                            3208K       54 
__LINKEDIT                        87.8M        8 
__TEXT                            15.4M       52 
__UNICODE                          552K        2 
shared memory                       12K        4 
===========                     =======  ======= 
TOTAL                            202.5M      134 

Model: MacBookPro11,5, BootROM MBP114.0172.B05, 4 processors, Intel Core i7, 2.8 GHz, 16 GB, SMC 2.30f2
Graphics: AMD Radeon R9 M370X, AMD Radeon R9 M370X, PCIe, 2048 MB
Graphics: Intel Iris Pro, Intel Iris Pro, Built-In
Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1600 MHz, 0x802C, 0x31364B544631473634485A2D314736453120
Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1600 MHz, 0x802C, 0x31364B544631473634485A2D314736453120
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x152), Broadcom BCM43xx 1.0 (7.21.94.25.1a3)
Bluetooth: Version 4.4.0f4 16320, 3 services, 27 devices, 1 incoming serial ports
Network Service: Wi-Fi, AirPort, en0
Serial ATA Device: APPLE SSD SM1024G, 1 TB
USB Device: USB 3.0 Bus
USB Device: Apple Internal Keyboard / Trackpad
USB Device: Bluetooth USB Host Controller
Thunderbolt Bus: MacBook Pro, Apple Inc., 27.1
I reported this issue on the GitHub the code came from.


Sources

https://github.com/ajakubek/python-sha3

http://stackoverflow.com/questions/12716204/have-keccak-sha-3-example-hashes-test-vectors-been-made-available

http://keccak.noekeon.org/files.html


Posted 12-1-15 2:26 pm by Sam Bowne