diff -rcb cracklib25_small/HISTORY cracklib26_small/HISTORY
*** cracklib25_small/HISTORY	Fri Jul  9 21:23:00 1993
--- cracklib26_small/HISTORY	Mon Dec 15 01:20:31 1997
***************
*** 1,5 ****
  v2.5	added decent info to the "shadow" directory patches.
- 
  v2.4	forwarded to ch & jfh3 for beta testing/comments
- 
  v2.3-	internal beta test versions
--- 1,5 ----
+ v2.6	buffer overflow problems addressed - 1st attempt
+ 	+ permutations of fascist deconstructors fixed/enhanced
  v2.5	added decent info to the "shadow" directory patches.
  v2.4	forwarded to ch & jfh3 for beta testing/comments
  v2.3-	internal beta test versions
diff -rcb cracklib25_small/Makefile cracklib26_small/Makefile
*** cracklib25_small/Makefile	Fri Jul  9 21:23:00 1993
--- cracklib26_small/Makefile	Sun Dec 14 23:25:07 1997
***************
*** 25,37 ****
  	( cd cracklib && make && exit $$? )
  	( cd util && make DICTPATH=$(DICTPATH) && exit $$? )
  ###	( cd passwd && make DICTPATH=$(DICTPATH) passwd && exit $$? )
! 	touch all
  
  clean:
  	-( cd cracklib && make clean && exit $$? )
  	-( cd util && make clean && exit $$? )
  ###	-( cd passwd && make clean && exit $$? )
! 	-rm -f all installed Part* *.BAK *.bak
  
  install: all
  	@echo 'if "sort" dies from lack of space, see "util/mkdict"'
--- 25,37 ----
  	( cd cracklib && make && exit $$? )
  	( cd util && make DICTPATH=$(DICTPATH) && exit $$? )
  ###	( cd passwd && make DICTPATH=$(DICTPATH) passwd && exit $$? )
! ###	touch all
  
  clean:
  	-( cd cracklib && make clean && exit $$? )
  	-( cd util && make clean && exit $$? )
  ###	-( cd passwd && make clean && exit $$? )
! 	-rm -f all installed Part* *.BAK *.bak *~
  
  install: all
  	@echo 'if "sort" dies from lack of space, see "util/mkdict"'
diff -rcb cracklib25_small/README cracklib26_small/README
*** cracklib25_small/README	Fri Jul  9 21:22:56 1993
--- cracklib26_small/README	Sun Dec 14 22:16:55 1997
***************
*** 1,11 ****
  CrackLib:	A ProActive Password Sanity Library
! 
! By: 		Alec Muffett, 16th June, 1993
! 
! Address:	alec.muffett@uk.sun.com
! 		alec.muffett@sun.co.uk
! 		alec_muffett@hicom.lut.ac.uk
! 
  
  - This software is not my fault in any way, nor indeed anybody's -
  
--- 1,7 ----
  CrackLib:	A ProActive Password Sanity Library
! By: 		Alec Muffett
! Address:	alecm@crypto.dircon.co.uk
! Date:		Sun Dec 14 22:16:48 GMT 1997
  
  - This software is not my fault in any way, nor indeed anybody's -
  
diff -rcb cracklib25_small/cracklib/Makefile cracklib26_small/cracklib/Makefile
*** cracklib25_small/cracklib/Makefile	Fri Jul  9 21:23:01 1993
--- cracklib26_small/cracklib/Makefile	Sun Dec 14 22:49:21 1997
***************
*** 15,18 ****
  	-ranlib $(LIB)
  
  clean:
! 	-rm -f $(OBJ) $(LIB)
--- 15,18 ----
  	-ranlib $(LIB)
  
  clean:
! 	-rm -f $(OBJ) $(LIB) *~
diff -rcb cracklib25_small/cracklib/fascist.c cracklib26_small/cracklib/fascist.c
*** cracklib25_small/cracklib/fascist.c	Fri Jul  9 21:22:57 1993
--- cracklib26_small/cracklib/fascist.c	Mon Dec 15 01:56:55 1997
***************
*** 6,12 ****
   * and upwards.
   */
  
! static char vers_id[] = "fascist.c : v2.3p2 Alec Muffett 18 May 1993";
  
  #include "packer.h"
  #include <ctype.h>
--- 6,12 ----
   * and upwards.
   */
  
! static char vers_id[] = "fascist.c : v2.3p3 Alec Muffett 14 dec 1997";
  
  #include "packer.h"
  #include <ctype.h>
***************
*** 19,24 ****
--- 19,27 ----
  #define MINLEN 6
  #define MAXSTEP 4
  
+ extern char *Reverse();
+ extern char *Lowercase();
+ 
  static char *r_destructors[] = {
      ":",                        /* noop - must do this to test raw word. */
  
***************
*** 33,126 ****
      "/?s@?s",
      "/?X@?X",
  
!     "/$s$s",			/* transmogrifying "$" back into "s", etc... */
!     "/4s4a",
!     "/2s2a",
!     "/3s3e",
!     "/0s0o",
!     "/1s1i",
!     "/4s4h",
!     "/1s1l",
!     "/$s$s/1s1l",
!     "/2s2a/3s3e",
!     "/0s0o/4s4h",
!     "/1s1l/4s4a",
!     "/2s2a/4s4h",
!     "/$s$s/3s3e",
      "/$s$s/0s0o",
!     "/1s1i/4s4a",
      "/$s$s/2s2a",
      "/$s$s/4s4a",
-     "/0s0o/1s1l",
-     "/3s3e/4s4h",
-     "/1s1l/4s4h",
      "/$s$s/4s4h",
!     "/1s1i/4s4h",
!     "/2s2a/4s4a",
!     "/$s$s/1s1i",
!     "/0s0o/1s1i",
!     "/1s1i/2s2a",
!     "/1s1i/3s3e",
!     "/0s0o/4s4a",
!     "/1s1l/3s3e",
!     "/3s3e/4s4a",
      "/0s0o/2s2a",
      "/0s0o/3s3e",
!     "/1s1l/2s2a",
!     "/0s0o/1s1l/2s2a",
      "/0s0o/1s1i/4s4h",
-     "/1s1l/2s2a/4s4a",
-     "/2s2a/3s3e/4s4a",
-     "/0s0o/1s1i/2s2a",
-     "/1s1i/2s2a/3s3e",
      "/0s0o/1s1l/4s4a",
-     "/1s1l/2s2a/4s4h",
-     "/$s$s/0s0o/1s1l",
-     "/$s$s/0s0o/2s2a",
-     "/0s0o/1s1i/3s3e",
-     "/$s$s/0s0o/3s3e",
-     "/1s1i/2s2a/4s4a",
-     "/$s$s/0s0o/4s4a",
-     "/$s$s/0s0o/4s4h",
      "/0s0o/1s1l/4s4h",
!     "/1s1i/2s2a/4s4h",
!     "/0s0o/1s1l/3s3e",
!     "/$s$s/0s0o/1s1i",
!     "/0s0o/1s1i/4s4a",
      "/2s2a/3s3e/4s4h",
!     "/1s1l/2s2a/3s3e",
!     "/$s$s/0s0o/1s1l/3s3e",
!     "/0s0o/1s1l/2s2a/4s4a",
!     "/0s0o/1s1i/2s2a/3s3e",
!     "/$s$s/0s0o/1s1i/4s4a",
!     "/$s$s/0s0o/1s1i/3s3e",
!     "/$s$s/0s0o/1s1l/4s4a",
!     "/0s0o/1s1l/2s2a/3s3e",
!     "/$s$s/0s0o/1s1i/2s2a",
!     "/1s1l/2s2a/3s3e/4s4a",
!     "/$s$s/0s0o/1s1l/2s2a",
!     "/$s$s/0s0o/1s1i/4s4h",
!     "/1s1i/2s2a/3s3e/4s4a",
!     "/0s0o/1s1i/2s2a/4s4a",
!     "/0s0o/1s1l/2s2a/4s4h",
!     "/1s1i/2s2a/3s3e/4s4h",
!     "/1s1l/2s2a/3s3e/4s4h",
!     "/0s0o/1s1i/2s2a/4s4h",
!     "/$s$s/0s0o/1s1l/4s4h",
!     "/$s$s/0s0o/1s1i/2s2a/4s4a",
!     "/$s$s/0s0o/1s1l/2s2a/4s4h",
!     "/$s$s/0s0o/1s1i/2s2a/4s4h",
!     "/0s0o/1s1l/2s2a/3s3e/4s4a",
!     "/$s$s/0s0o/1s1l/2s2a/4s4a",
!     "/0s0o/1s1i/2s2a/3s3e/4s4a",
!     "/0s0o/1s1i/2s2a/3s3e/4s4h",
!     "/$s$s/0s0o/1s1l/2s2a/3s3e",
!     "/0s0o/1s1l/2s2a/3s3e/4s4h",
!     "/$s$s/0s0o/1s1i/2s2a/3s3e",
!     "/$s$s/0s0o/1s1l/2s2a/3s3e/4s4h",
!     "/$s$s/0s0o/1s1l/2s2a/3s3e/4s4a",
!     "/$s$s/0s0o/1s1i/2s2a/3s3e/4s4a",
!     "/$s$s/0s0o/1s1i/2s2a/3s3e/4s4h",
      (char *) 0
  };
  
--- 36,396 ----
      "/?s@?s",
      "/?X@?X",
  
!     /* attempt reverse engineering of password strings */
! 
!     "/$s$s",
      "/$s$s/0s0o",
!     "/$s$s/0s0o/2s2a",
!     "/$s$s/0s0o/2s2a/3s3e",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1i",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1l",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1i/4s4a",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1i/4s4h",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1l/4s4a",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1l/4s4h",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/4s4a",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/4s4h",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/4s4a",
!     "/$s$s/0s0o/2s2a/3s3e/5s5s/4s4h",
!     "/$s$s/0s0o/2s2a/3s3e/1s1i",
!     "/$s$s/0s0o/2s2a/3s3e/1s1l",
!     "/$s$s/0s0o/2s2a/3s3e/1s1i/4s4a",
!     "/$s$s/0s0o/2s2a/3s3e/1s1i/4s4h",
!     "/$s$s/0s0o/2s2a/3s3e/1s1l/4s4a",
!     "/$s$s/0s0o/2s2a/3s3e/1s1l/4s4h",
!     "/$s$s/0s0o/2s2a/3s3e/4s4a",
!     "/$s$s/0s0o/2s2a/3s3e/4s4h",
!     "/$s$s/0s0o/2s2a/3s3e/4s4a",
!     "/$s$s/0s0o/2s2a/3s3e/4s4h",
!     "/$s$s/0s0o/2s2a/5s5s",
!     "/$s$s/0s0o/2s2a/5s5s/1s1i",
!     "/$s$s/0s0o/2s2a/5s5s/1s1l",
!     "/$s$s/0s0o/2s2a/5s5s/1s1i/4s4a",
!     "/$s$s/0s0o/2s2a/5s5s/1s1i/4s4h",
!     "/$s$s/0s0o/2s2a/5s5s/1s1l/4s4a",
!     "/$s$s/0s0o/2s2a/5s5s/1s1l/4s4h",
!     "/$s$s/0s0o/2s2a/5s5s/4s4a",
!     "/$s$s/0s0o/2s2a/5s5s/4s4h",
!     "/$s$s/0s0o/2s2a/5s5s/4s4a",
!     "/$s$s/0s0o/2s2a/5s5s/4s4h",
!     "/$s$s/0s0o/2s2a/1s1i",
!     "/$s$s/0s0o/2s2a/1s1l",
!     "/$s$s/0s0o/2s2a/1s1i/4s4a",
!     "/$s$s/0s0o/2s2a/1s1i/4s4h",
!     "/$s$s/0s0o/2s2a/1s1l/4s4a",
!     "/$s$s/0s0o/2s2a/1s1l/4s4h",
!     "/$s$s/0s0o/2s2a/4s4a",
!     "/$s$s/0s0o/2s2a/4s4h",
!     "/$s$s/0s0o/2s2a/4s4a",
!     "/$s$s/0s0o/2s2a/4s4h",
!     "/$s$s/0s0o/3s3e",
!     "/$s$s/0s0o/3s3e/5s5s",
!     "/$s$s/0s0o/3s3e/5s5s/1s1i",
!     "/$s$s/0s0o/3s3e/5s5s/1s1l",
!     "/$s$s/0s0o/3s3e/5s5s/1s1i/4s4a",
!     "/$s$s/0s0o/3s3e/5s5s/1s1i/4s4h",
!     "/$s$s/0s0o/3s3e/5s5s/1s1l/4s4a",
!     "/$s$s/0s0o/3s3e/5s5s/1s1l/4s4h",
!     "/$s$s/0s0o/3s3e/5s5s/4s4a",
!     "/$s$s/0s0o/3s3e/5s5s/4s4h",
!     "/$s$s/0s0o/3s3e/5s5s/4s4a",
!     "/$s$s/0s0o/3s3e/5s5s/4s4h",
!     "/$s$s/0s0o/3s3e/1s1i",
!     "/$s$s/0s0o/3s3e/1s1l",
!     "/$s$s/0s0o/3s3e/1s1i/4s4a",
!     "/$s$s/0s0o/3s3e/1s1i/4s4h",
!     "/$s$s/0s0o/3s3e/1s1l/4s4a",
!     "/$s$s/0s0o/3s3e/1s1l/4s4h",
!     "/$s$s/0s0o/3s3e/4s4a",
!     "/$s$s/0s0o/3s3e/4s4h",
!     "/$s$s/0s0o/3s3e/4s4a",
!     "/$s$s/0s0o/3s3e/4s4h",
!     "/$s$s/0s0o/5s5s",
!     "/$s$s/0s0o/5s5s/1s1i",
!     "/$s$s/0s0o/5s5s/1s1l",
!     "/$s$s/0s0o/5s5s/1s1i/4s4a",
!     "/$s$s/0s0o/5s5s/1s1i/4s4h",
!     "/$s$s/0s0o/5s5s/1s1l/4s4a",
!     "/$s$s/0s0o/5s5s/1s1l/4s4h",
!     "/$s$s/0s0o/5s5s/4s4a",
!     "/$s$s/0s0o/5s5s/4s4h",
!     "/$s$s/0s0o/5s5s/4s4a",
!     "/$s$s/0s0o/5s5s/4s4h",
!     "/$s$s/0s0o/1s1i",
!     "/$s$s/0s0o/1s1l",
!     "/$s$s/0s0o/1s1i/4s4a",
!     "/$s$s/0s0o/1s1i/4s4h",
!     "/$s$s/0s0o/1s1l/4s4a",
!     "/$s$s/0s0o/1s1l/4s4h",
!     "/$s$s/0s0o/4s4a",
!     "/$s$s/0s0o/4s4h",
!     "/$s$s/0s0o/4s4a",
!     "/$s$s/0s0o/4s4h",
      "/$s$s/2s2a",
+     "/$s$s/2s2a/3s3e",
+     "/$s$s/2s2a/3s3e/5s5s",
+     "/$s$s/2s2a/3s3e/5s5s/1s1i",
+     "/$s$s/2s2a/3s3e/5s5s/1s1l",
+     "/$s$s/2s2a/3s3e/5s5s/1s1i/4s4a",
+     "/$s$s/2s2a/3s3e/5s5s/1s1i/4s4h",
+     "/$s$s/2s2a/3s3e/5s5s/1s1l/4s4a",
+     "/$s$s/2s2a/3s3e/5s5s/1s1l/4s4h",
+     "/$s$s/2s2a/3s3e/5s5s/4s4a",
+     "/$s$s/2s2a/3s3e/5s5s/4s4h",
+     "/$s$s/2s2a/3s3e/5s5s/4s4a",
+     "/$s$s/2s2a/3s3e/5s5s/4s4h",
+     "/$s$s/2s2a/3s3e/1s1i",
+     "/$s$s/2s2a/3s3e/1s1l",
+     "/$s$s/2s2a/3s3e/1s1i/4s4a",
+     "/$s$s/2s2a/3s3e/1s1i/4s4h",
+     "/$s$s/2s2a/3s3e/1s1l/4s4a",
+     "/$s$s/2s2a/3s3e/1s1l/4s4h",
+     "/$s$s/2s2a/3s3e/4s4a",
+     "/$s$s/2s2a/3s3e/4s4h",
+     "/$s$s/2s2a/3s3e/4s4a",
+     "/$s$s/2s2a/3s3e/4s4h",
+     "/$s$s/2s2a/5s5s",
+     "/$s$s/2s2a/5s5s/1s1i",
+     "/$s$s/2s2a/5s5s/1s1l",
+     "/$s$s/2s2a/5s5s/1s1i/4s4a",
+     "/$s$s/2s2a/5s5s/1s1i/4s4h",
+     "/$s$s/2s2a/5s5s/1s1l/4s4a",
+     "/$s$s/2s2a/5s5s/1s1l/4s4h",
+     "/$s$s/2s2a/5s5s/4s4a",
+     "/$s$s/2s2a/5s5s/4s4h",
+     "/$s$s/2s2a/5s5s/4s4a",
+     "/$s$s/2s2a/5s5s/4s4h",
+     "/$s$s/2s2a/1s1i",
+     "/$s$s/2s2a/1s1l",
+     "/$s$s/2s2a/1s1i/4s4a",
+     "/$s$s/2s2a/1s1i/4s4h",
+     "/$s$s/2s2a/1s1l/4s4a",
+     "/$s$s/2s2a/1s1l/4s4h",
+     "/$s$s/2s2a/4s4a",
+     "/$s$s/2s2a/4s4h",
+     "/$s$s/2s2a/4s4a",
+     "/$s$s/2s2a/4s4h",
+     "/$s$s/3s3e",
+     "/$s$s/3s3e/5s5s",
+     "/$s$s/3s3e/5s5s/1s1i",
+     "/$s$s/3s3e/5s5s/1s1l",
+     "/$s$s/3s3e/5s5s/1s1i/4s4a",
+     "/$s$s/3s3e/5s5s/1s1i/4s4h",
+     "/$s$s/3s3e/5s5s/1s1l/4s4a",
+     "/$s$s/3s3e/5s5s/1s1l/4s4h",
+     "/$s$s/3s3e/5s5s/4s4a",
+     "/$s$s/3s3e/5s5s/4s4h",
+     "/$s$s/3s3e/5s5s/4s4a",
+     "/$s$s/3s3e/5s5s/4s4h",
+     "/$s$s/3s3e/1s1i",
+     "/$s$s/3s3e/1s1l",
+     "/$s$s/3s3e/1s1i/4s4a",
+     "/$s$s/3s3e/1s1i/4s4h",
+     "/$s$s/3s3e/1s1l/4s4a",
+     "/$s$s/3s3e/1s1l/4s4h",
+     "/$s$s/3s3e/4s4a",
+     "/$s$s/3s3e/4s4h",
+     "/$s$s/3s3e/4s4a",
+     "/$s$s/3s3e/4s4h",
+     "/$s$s/5s5s",
+     "/$s$s/5s5s/1s1i",
+     "/$s$s/5s5s/1s1l",
+     "/$s$s/5s5s/1s1i/4s4a",
+     "/$s$s/5s5s/1s1i/4s4h",
+     "/$s$s/5s5s/1s1l/4s4a",
+     "/$s$s/5s5s/1s1l/4s4h",
+     "/$s$s/5s5s/4s4a",
+     "/$s$s/5s5s/4s4h",
+     "/$s$s/5s5s/4s4a",
+     "/$s$s/5s5s/4s4h",
+     "/$s$s/1s1i",
+     "/$s$s/1s1l",
+     "/$s$s/1s1i/4s4a",
+     "/$s$s/1s1i/4s4h",
+     "/$s$s/1s1l/4s4a",
+     "/$s$s/1s1l/4s4h",
      "/$s$s/4s4a",
      "/$s$s/4s4h",
!     "/$s$s/4s4a",
!     "/$s$s/4s4h",
!     "/0s0o",
      "/0s0o/2s2a",
+     "/0s0o/2s2a/3s3e",
+     "/0s0o/2s2a/3s3e/5s5s",
+     "/0s0o/2s2a/3s3e/5s5s/1s1i",
+     "/0s0o/2s2a/3s3e/5s5s/1s1l",
+     "/0s0o/2s2a/3s3e/5s5s/1s1i/4s4a",
+     "/0s0o/2s2a/3s3e/5s5s/1s1i/4s4h",
+     "/0s0o/2s2a/3s3e/5s5s/1s1l/4s4a",
+     "/0s0o/2s2a/3s3e/5s5s/1s1l/4s4h",
+     "/0s0o/2s2a/3s3e/5s5s/4s4a",
+     "/0s0o/2s2a/3s3e/5s5s/4s4h",
+     "/0s0o/2s2a/3s3e/5s5s/4s4a",
+     "/0s0o/2s2a/3s3e/5s5s/4s4h",
+     "/0s0o/2s2a/3s3e/1s1i",
+     "/0s0o/2s2a/3s3e/1s1l",
+     "/0s0o/2s2a/3s3e/1s1i/4s4a",
+     "/0s0o/2s2a/3s3e/1s1i/4s4h",
+     "/0s0o/2s2a/3s3e/1s1l/4s4a",
+     "/0s0o/2s2a/3s3e/1s1l/4s4h",
+     "/0s0o/2s2a/3s3e/4s4a",
+     "/0s0o/2s2a/3s3e/4s4h",
+     "/0s0o/2s2a/3s3e/4s4a",
+     "/0s0o/2s2a/3s3e/4s4h",
+     "/0s0o/2s2a/5s5s",
+     "/0s0o/2s2a/5s5s/1s1i",
+     "/0s0o/2s2a/5s5s/1s1l",
+     "/0s0o/2s2a/5s5s/1s1i/4s4a",
+     "/0s0o/2s2a/5s5s/1s1i/4s4h",
+     "/0s0o/2s2a/5s5s/1s1l/4s4a",
+     "/0s0o/2s2a/5s5s/1s1l/4s4h",
+     "/0s0o/2s2a/5s5s/4s4a",
+     "/0s0o/2s2a/5s5s/4s4h",
+     "/0s0o/2s2a/5s5s/4s4a",
+     "/0s0o/2s2a/5s5s/4s4h",
+     "/0s0o/2s2a/1s1i",
+     "/0s0o/2s2a/1s1l",
+     "/0s0o/2s2a/1s1i/4s4a",
+     "/0s0o/2s2a/1s1i/4s4h",
+     "/0s0o/2s2a/1s1l/4s4a",
+     "/0s0o/2s2a/1s1l/4s4h",
+     "/0s0o/2s2a/4s4a",
+     "/0s0o/2s2a/4s4h",
+     "/0s0o/2s2a/4s4a",
+     "/0s0o/2s2a/4s4h",
      "/0s0o/3s3e",
!     "/0s0o/3s3e/5s5s",
!     "/0s0o/3s3e/5s5s/1s1i",
!     "/0s0o/3s3e/5s5s/1s1l",
!     "/0s0o/3s3e/5s5s/1s1i/4s4a",
!     "/0s0o/3s3e/5s5s/1s1i/4s4h",
!     "/0s0o/3s3e/5s5s/1s1l/4s4a",
!     "/0s0o/3s3e/5s5s/1s1l/4s4h",
!     "/0s0o/3s3e/5s5s/4s4a",
!     "/0s0o/3s3e/5s5s/4s4h",
!     "/0s0o/3s3e/5s5s/4s4a",
!     "/0s0o/3s3e/5s5s/4s4h",
!     "/0s0o/3s3e/1s1i",
!     "/0s0o/3s3e/1s1l",
!     "/0s0o/3s3e/1s1i/4s4a",
!     "/0s0o/3s3e/1s1i/4s4h",
!     "/0s0o/3s3e/1s1l/4s4a",
!     "/0s0o/3s3e/1s1l/4s4h",
!     "/0s0o/3s3e/4s4a",
!     "/0s0o/3s3e/4s4h",
!     "/0s0o/3s3e/4s4a",
!     "/0s0o/3s3e/4s4h",
!     "/0s0o/5s5s",
!     "/0s0o/5s5s/1s1i",
!     "/0s0o/5s5s/1s1l",
!     "/0s0o/5s5s/1s1i/4s4a",
!     "/0s0o/5s5s/1s1i/4s4h",
!     "/0s0o/5s5s/1s1l/4s4a",
!     "/0s0o/5s5s/1s1l/4s4h",
!     "/0s0o/5s5s/4s4a",
!     "/0s0o/5s5s/4s4h",
!     "/0s0o/5s5s/4s4a",
!     "/0s0o/5s5s/4s4h",
!     "/0s0o/1s1i",
!     "/0s0o/1s1l",
!     "/0s0o/1s1i/4s4a",
      "/0s0o/1s1i/4s4h",
      "/0s0o/1s1l/4s4a",
      "/0s0o/1s1l/4s4h",
!     "/0s0o/4s4a",
!     "/0s0o/4s4h",
!     "/0s0o/4s4a",
!     "/0s0o/4s4h",
!     "/2s2a",
!     "/2s2a/3s3e",
!     "/2s2a/3s3e/5s5s",
!     "/2s2a/3s3e/5s5s/1s1i",
!     "/2s2a/3s3e/5s5s/1s1l",
!     "/2s2a/3s3e/5s5s/1s1i/4s4a",
!     "/2s2a/3s3e/5s5s/1s1i/4s4h",
!     "/2s2a/3s3e/5s5s/1s1l/4s4a",
!     "/2s2a/3s3e/5s5s/1s1l/4s4h",
!     "/2s2a/3s3e/5s5s/4s4a",
!     "/2s2a/3s3e/5s5s/4s4h",
!     "/2s2a/3s3e/5s5s/4s4a",
!     "/2s2a/3s3e/5s5s/4s4h",
!     "/2s2a/3s3e/1s1i",
!     "/2s2a/3s3e/1s1l",
!     "/2s2a/3s3e/1s1i/4s4a",
!     "/2s2a/3s3e/1s1i/4s4h",
!     "/2s2a/3s3e/1s1l/4s4a",
!     "/2s2a/3s3e/1s1l/4s4h",
!     "/2s2a/3s3e/4s4a",
      "/2s2a/3s3e/4s4h",
!     "/2s2a/3s3e/4s4a",
!     "/2s2a/3s3e/4s4h",
!     "/2s2a/5s5s",
!     "/2s2a/5s5s/1s1i",
!     "/2s2a/5s5s/1s1l",
!     "/2s2a/5s5s/1s1i/4s4a",
!     "/2s2a/5s5s/1s1i/4s4h",
!     "/2s2a/5s5s/1s1l/4s4a",
!     "/2s2a/5s5s/1s1l/4s4h",
!     "/2s2a/5s5s/4s4a",
!     "/2s2a/5s5s/4s4h",
!     "/2s2a/5s5s/4s4a",
!     "/2s2a/5s5s/4s4h",
!     "/2s2a/1s1i",
!     "/2s2a/1s1l",
!     "/2s2a/1s1i/4s4a",
!     "/2s2a/1s1i/4s4h",
!     "/2s2a/1s1l/4s4a",
!     "/2s2a/1s1l/4s4h",
!     "/2s2a/4s4a",
!     "/2s2a/4s4h",
!     "/2s2a/4s4a",
!     "/2s2a/4s4h",
!     "/3s3e",
!     "/3s3e/5s5s",
!     "/3s3e/5s5s/1s1i",
!     "/3s3e/5s5s/1s1l",
!     "/3s3e/5s5s/1s1i/4s4a",
!     "/3s3e/5s5s/1s1i/4s4h",
!     "/3s3e/5s5s/1s1l/4s4a",
!     "/3s3e/5s5s/1s1l/4s4h",
!     "/3s3e/5s5s/4s4a",
!     "/3s3e/5s5s/4s4h",
!     "/3s3e/5s5s/4s4a",
!     "/3s3e/5s5s/4s4h",
!     "/3s3e/1s1i",
!     "/3s3e/1s1l",
!     "/3s3e/1s1i/4s4a",
!     "/3s3e/1s1i/4s4h",
!     "/3s3e/1s1l/4s4a",
!     "/3s3e/1s1l/4s4h",
!     "/3s3e/4s4a",
!     "/3s3e/4s4h",
!     "/3s3e/4s4a",
!     "/3s3e/4s4h",
!     "/5s5s",
!     "/5s5s/1s1i",
!     "/5s5s/1s1l",
!     "/5s5s/1s1i/4s4a",
!     "/5s5s/1s1i/4s4h",
!     "/5s5s/1s1l/4s4a",
!     "/5s5s/1s1l/4s4h",
!     "/5s5s/4s4a",
!     "/5s5s/4s4h",
!     "/5s5s/4s4a",
!     "/5s5s/4s4h",
!     "/1s1i",
!     "/1s1l",
!     "/1s1i/4s4a",
!     "/1s1i/4s4h",
!     "/1s1l/4s4a",
!     "/1s1l/4s4h",
!     "/4s4a",
!     "/4s4h",
!     "/4s4a",
!     "/4s4h",
! 
!     /* done */
      (char *) 0
  };
  
***************
*** 137,148 ****
  
  int
  GTry(rawtext, password)
!     register char *rawtext;
!     register char *password;
  {
!     register int i;
!     register char *mp;
      int len;
  
      /* use destructors to turn password into rawtext */
      /* note use of Reverse() to save duplicating all rules */
--- 407,418 ----
  
  int
  GTry(rawtext, password)
!     char *rawtext;
!     char *password;
  {
!     int i;
      int len;
+     char *mp;
  
      /* use destructors to turn password into rawtext */
      /* note use of Reverse() to save duplicating all rules */
***************
*** 155,161 ****
  	{
  	    continue;
  	}
- 
  #ifdef DEBUG
  	printf("d1->\t%s vs %s\n", mp, rawtext);
  #endif
--- 425,430 ----
***************
*** 172,179 ****
  	}
      }
  
-     /* use constructors to turn rawtext into password */
- 
      for (i = 0; r_constructors[i]; i++)
      {
  	if (!(mp = Mangle(rawtext, r_constructors[i])))
--- 441,446 ----
***************
*** 200,223 ****
      int i;
      int j;
      int wc;
      struct passwd *pwp;
      char gbuffer[STRINGSIZE];
      char *uwords[STRINGSIZE];
!     char buffer[STRINGSIZE];
!     register char *ptr = 
!         "\101\154\145\143\127\141\163\110\145\162\145";
  
      if (!(pwp = getpwuid(uid)))
      {
  	return ("you are not registered in the password file");
      }
  
!     if (GTry(pwp->pw_name, password))
      {
  	return ("it is based on your username");
      }
  
!     strcpy(gbuffer, Lowercase(pwp->pw_gecos));
  
      wc = 0;
      ptr = gbuffer;
--- 467,498 ----
      int i;
      int j;
      int wc;
+     char *ptr;
      struct passwd *pwp;
      char gbuffer[STRINGSIZE];
+     char tbuffer[STRINGSIZE];
      char *uwords[STRINGSIZE];
!     char longbuffer[STRINGSIZE * 2];
  
      if (!(pwp = getpwuid(uid)))
      {
  	return ("you are not registered in the password file");
      }
  
!     /* lets get really paranoid and assume a dangerously long gecos entry */
! 
!     strncpy(tbuffer, pwp->pw_name, STRINGSIZE);
!     tbuffer[STRINGSIZE-1] = '\0';
!     if (GTry(tbuffer, password))
      {
  	return ("it is based on your username");
      }
  
!     /* it never used to be that you got passwd strings > 1024 chars, but now... */
! 
!     strncpy(tbuffer, pwp->pw_gecos, STRINGSIZE);
!     tbuffer[STRINGSIZE-1] = '\0';
!     strcpy(gbuffer, Lowercase(tbuffer));
  
      wc = 0;
      ptr = gbuffer;
***************
*** 269,304 ****
  	}
      }
  
      for (j = 1; uwords[j]; j++)
      {
  	for (i = 0; i < j; i++)
  	{
! 	    strcpy(buffer, uwords[i]);
! 	    strcat(buffer, uwords[j]);
! 	    if (GTry(buffer, password))
  	    {
  		return ("it is derived from your password entry");
  	    }
  
! 	    strcpy(buffer, uwords[j]);
! 	    strcat(buffer, uwords[i]);
! 	    if (GTry(buffer, password))
  	    {
  		return ("it's derived from your password entry");
  	    }
  
! 	    buffer[0] = uwords[i][0];
! 	    buffer[1] = '\0';
! 	    strcat(buffer, uwords[j]);
! 	    if (GTry(buffer, password))
  	    {
  		return ("it is derivable from your password entry");
  	    }
  
! 	    buffer[0] = uwords[j][0];
! 	    buffer[1] = '\0';
! 	    strcat(buffer, uwords[i]);
! 	    if (GTry(buffer, password))
  	    {
  		return ("it's derivable from your password entry");
  	    }
--- 544,581 ----
  	}
      }
  
+     /* since uwords are taken from gbuffer, no uword can be longer than gbuffer */
+ 
      for (j = 1; uwords[j]; j++)
      {
  	for (i = 0; i < j; i++)
  	{
! 	    strcpy(longbuffer, uwords[i]);
! 	    strcat(longbuffer, uwords[j]);
! 	    if (GTry(longbuffer, password))
  	    {
  		return ("it is derived from your password entry");
  	    }
  
! 	    strcpy(longbuffer, uwords[j]);
! 	    strcat(longbuffer, uwords[i]);
! 	    if (GTry(longbuffer, password))
  	    {
  		return ("it's derived from your password entry");
  	    }
  
! 	    longbuffer[0] = uwords[i][0];
! 	    longbuffer[1] = '\0';
! 	    strcat(longbuffer, uwords[j]);
! 	    if (GTry(longbuffer, password))
  	    {
  		return ("it is derivable from your password entry");
  	    }
  
! 	    longbuffer[0] = uwords[j][0];
! 	    longbuffer[1] = '\0';
! 	    strcat(longbuffer, uwords[i]);
! 	    if (GTry(longbuffer, password))
  	    {
  		return ("it's derivable from your password entry");
  	    }
***************
*** 313,333 ****
      PWDICT *pwp;
      char *instring;
  {
!     register int i;
!     register char *ptr;
      char junk[STRINGSIZE];
!     register char *jptr;
      char rpassword[STRINGSIZE];
-     register char *password;
      int32 notfound;
  
      notfound = PW_WORDS(pwp);
      password = rpassword;
  
-     strncpy(password, instring, STRINGSIZE);
- 
-     password[STRINGSIZE - 1] = '\0';
- 
      if (strlen(password) < 4)
      {
  	return ("it's WAY too short");
--- 590,610 ----
      PWDICT *pwp;
      char *instring;
  {
!     int i;
!     char *ptr;
!     char *jptr;
      char junk[STRINGSIZE];
!     char *password;
      char rpassword[STRINGSIZE];
      int32 notfound;
  
      notfound = PW_WORDS(pwp);
+     /* already truncated if from FascistCheck() */
+     /* but pretend it wasn't ... */
+     strncpy(rpassword, instring, TRUNCSTRINGSIZE);
+     rpassword[TRUNCSTRINGSIZE - 1] = '\0';
      password = rpassword;
  
      if (strlen(password) < 4)
      {
  	return ("it's WAY too short");
***************
*** 395,400 ****
--- 672,681 ----
  	return (ptr);
      }
  
+     /* it should be safe to use Mangle with its reliance on STRINGSIZE
+        since password cannot be longer than TRUNCSTRINGSIZE;
+        nonetheless this is not an elegant solution */
+ 
      for (i = 0; r_destructors[i]; i++)
      {
  	char *a;
***************
*** 402,407 ****
--- 683,691 ----
  	{
  	    continue;
  	}
+ #ifdef DEBUG
+ 	printf("g: %s\n", a);
+ #endif
  	if (FindPW(pwp, a) != notfound)
  	{
  	    return ("it is based on a dictionary word");
***************
*** 418,424 ****
  	{
  	    continue;
  	}
! 
  	if (FindPW(pwp, a) != notfound)
  	{
  	    return ("it is based on a (reversed) dictionary word");
--- 702,710 ----
  	{
  	    continue;
  	}
! #ifdef DEBUG
! 	printf("G: %s\n", a);
! #endif
  	if (FindPW(pwp, a) != notfound)
  	{
  	    return ("it is based on a (reversed) dictionary word");
***************
*** 433,440 ****
      char *password;
      char *path;
  {
-     static PWDICT *pwp;
      static char lastpath[STRINGSIZE];
  
      if (pwp && strncmp(lastpath, path, STRINGSIZE))
      {
--- 719,738 ----
      char *password;
      char *path;
  {
      static char lastpath[STRINGSIZE];
+     static PWDICT *pwp;
+     char pwtrunced[STRINGSIZE];
+ 
+     /* security problem: assume we may have been given a really long
+        password (buffer attack) and so truncate it to a workable size;
+        try to define workable size as something from which we cannot
+        extend a buffer beyond its limits in the rest of the code */
+ 
+     strncpy(pwtrunced, password, TRUNCSTRINGSIZE);
+     pwtrunced[TRUNCSTRINGSIZE - 1] = '\0'; /* enforce */
+ 
+     /* perhaps someone should put something here to check if password
+        is really long and syslog() a message denoting buffer attacks?  */
  
      if (pwp && strncmp(lastpath, path, STRINGSIZE))
      {
***************
*** 452,456 ****
  	strncpy(lastpath, path, STRINGSIZE);
      }
  
!     return (FascistLook(pwp, password));
  }
--- 750,754 ----
  	strncpy(lastpath, path, STRINGSIZE);
      }
  
!     return (FascistLook(pwp, pwtrunced));
  }
diff -rcb cracklib25_small/cracklib/genrules.pl cracklib26_small/cracklib/genrules.pl
*** cracklib25_small/cracklib/genrules.pl	Fri Jul  9 21:23:01 1993
--- cracklib26_small/cracklib/genrules.pl	Mon Dec 15 01:15:49 1997
***************
*** 1,50 ****
  #!/usr/local/bin/perl
  
  ###
! # This program is copyright Alec Muffett 1993. The author disclaims all
  # responsibility or liability with respect to it's usage or its effect
  # upon hardware or computer systems, and maintains copyright as set out
! # in the "LICENCE" document which accompanies distributions of Crack v4.0
  # and upwards.
  ###
  
! sub ByLen {
! 	length($a) <=> length($b);
! }
! 
! @a1 = ('/$s$s', '/0s0o', '/1s1i', '/2s2a', '/3s3e', '/4s4h');
! @a2 = ('/$s$s', '/0s0o', '/1s1l', '/2s2a', '/3s3e', '/4s4h');
! @a3 = ('/$s$s', '/0s0o', '/1s1i', '/2s2a', '/3s3e', '/4s4a');
! @a4 = ('/$s$s', '/0s0o', '/1s1l', '/2s2a', '/3s3e', '/4s4a');
  
! sub Permute {
! 	local(@args) = @_;
! 	local($prefix);
  
! 	while ($#args >= 0)
  	{
! 		@foo = @args;
! 		$prefix = "";
  
! 		while ($#foo >= 0)
  		{
! 			foreach (@foo)
  			{
! 				$foo{"$prefix$_"}++;
  			}
! 			$prefix .= shift(@foo);
  		}
- 
- 		shift(@args);
  	}
  }
  
! &Permute(@a1);
! &Permute(@a2);
! &Permute(@a3);
! &Permute(@a4);
  
! foreach $key (sort ByLen (keys(%foo)))
  {
! 	print $key, "\n";
  }
--- 1,68 ----
  #!/usr/local/bin/perl
  
  ###
! # This program is copyright Alec Muffett 1997. The author disclaims all
  # responsibility or liability with respect to it's usage or its effect
  # upon hardware or computer systems, and maintains copyright as set out
! # in the "LICENCE" document which accompanies distributions of Crack v5.0
  # and upwards.
  ###
  
! %perms = ();
  
! sub Permute
! {
!     my $depth = shift;
!     my $i;
  
!     if ($depth == 0)
!     {
! 	@stack = ();
!     }
!     for ($i = 0; $i <= $#set; $i++)
      {
! 	$stack[$depth] = $set[$i];
  
! 	if ($depth == $#set)
  	{
! 	    %output = ();
! 	    foreach (@stack) 
  	    { 
! 		$output{$_}++; 
  	    }
! 	    $perm = join(" ", sort(keys(%output)));
! 	    $perms{$perm}++;
! 	}
! 	else
! 	{
! 	    &Permute($depth + 1);
  	}
      }
  }
  
! @maps = ([ '/$s$s', '/0s0o', '/2s2a', '/3s3e', '/5s5s', '/1s1i', '/4s4a' ],
! 	 [ '/$s$s', '/0s0o', '/2s2a', '/3s3e', '/5s5s', '/1s1i', '/4s4h' ],
! 	 [ '/$s$s', '/0s0o', '/2s2a', '/3s3e', '/5s5s', '/1s1l', '/4s4a' ],
! 	 [ '/$s$s', '/0s0o', '/2s2a', '/3s3e', '/5s5s', '/1s1l', '/4s4h' ]);
  
! @set = (0 .. 5);
! 
! # why be elegant when you can use brute force?  moreover, it's easier
! # to think brute-force at 1am in the morning, and leaves you with time
! # for coffee...
! 
! &Permute(0);
! 
! foreach $perm (sort(keys(%perms)))
  {
!     foreach $aref (@maps)
!     {
! 	foreach $i (split(" ", $perm))
! 	{
! 	    print ${$aref}[$i];
! 	}
! 	print "\n";
!     }
  }
+ 
+ exit 0;
diff -rcb cracklib25_small/cracklib/packer.h cracklib26_small/cracklib/packer.h
*** cracklib25_small/cracklib/packer.h	Fri Jul  9 21:23:02 1993
--- cracklib26_small/cracklib/packer.h	Sun Dec 14 23:09:30 1997
***************
*** 8,14 ****
  
  #include <stdio.h>
  
! #define STRINGSIZE	256
  
  typedef unsigned char int8;
  typedef unsigned short int int16;
--- 8,15 ----
  
  #include <stdio.h>
  
! #define STRINGSIZE	1024
! #define TRUNCSTRINGSIZE	(STRINGSIZE/4)
  
  typedef unsigned char int8;
  typedef unsigned short int int16;
diff -rcb cracklib25_small/util/Makefile cracklib26_small/util/Makefile
*** cracklib25_small/util/Makefile	Fri Jul  9 21:23:03 1993
--- cracklib26_small/util/Makefile	Sun Dec 14 22:49:34 1997
***************
*** 11,17 ****
  # If you ARE, then leave it and suffer a few extra Kb for security's sake
  ###
  
! CFLAGS= -O -I../cracklib '-DCRACKLIB_DICTPATH="$(DICTPATH)"' -Bstatic
  LIBS=	../cracklib/libcrack.a
  
  all:	packer unpacker testnum teststr testlib
--- 11,20 ----
  # If you ARE, then leave it and suffer a few extra Kb for security's sake
  ###
  
! #SunOS users (and others?) should consider static linking of their passwd binary
! #CFLAGS= -O -I../cracklib '-DCRACKLIB_DICTPATH="$(DICTPATH)"' -Bstatic
! 
! CFLAGS= -O -I../cracklib '-DCRACKLIB_DICTPATH="$(DICTPATH)"'
  LIBS=	../cracklib/libcrack.a
  
  all:	packer unpacker testnum teststr testlib
***************
*** 33,37 ****
  	cc $(CFLAGS) -o $@ $@.o $(LIBS)
  
  clean:
! 	-rm *.o all
  	-rm teststr testnum testlib packer unpacker
--- 36,40 ----
  	cc $(CFLAGS) -o $@ $@.o $(LIBS)
  
  clean:
! 	-rm *.o *~ all
  	-rm teststr testnum testlib packer unpacker
