Original issue 26 created by valient on 2011-01-18T08:24:54.000Z:

Noticed that DISALLOW_REUSE was not being correctly maintained. To more easily demonstrate the problem, I extracted invalidate_timebased_code into a separate test program and called it multiple times in a loop, here is the progression:

ABABABABABABABA
" DISALLOW_REUSE 43177960
" TOTP_AUTH
1234567

ABABABABABABABA
" DISALLOW_REUSE 43177960 43177961
" TOTP_AUTH
1234567

ABABABABABABABA
" DISALLOW_REUSE 43177960 43177961 43177962
" TOTP_AUTH
1234567

ABABABABABABABA
" DISALLOW_REUSE 43177960 43177961 43177962 43177963
" TOTP_AUTH
1234567

ABABABABABABABA
" DISALLOW_REUSE43177961 43177962 43177963 43177964
" TOTP_AUTH
1234567

ABABABABABABABA
" DISALLOW_REUSE43177961 43177962 43177963 43177964 43177965
" TOTP_AUTH
1234567

ABABABABABABABA
" DISALLOW_REUSE4317796143177963 43177964 43177965 43177966
" TOTP_AUTH
1234567

... It continues to get worse every 2 iterations.

My wrapper code used for testing:

int main(int argc, char **argv)
{
char *buf = strdup("ABABABABABABABA\n"
"" DISALLOW_REUSE\n"
"" TOTP_AUTH\n"
"1234567\n");

int tm = get_timestamp();
for(int i=0; i<10; ++i, ++tm) {
invalidate_timebased_code(tm, &buf);
}

return 0;
}