Attachment 630158 Details for Bug 926169

[patch] random-seed-accidental-stack-corruption.patch

0001-random-seed-accidental-stack-corruption.patch (text/plain), 1.71 KB, created by Hannes Reinecke on 2015-04-07 09:32:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Hannes Reinecke

Created: 2015-04-07 09:32:25 UTC

Size: 1.71 KB

patch

obsolete

>From ae139637b61eb8a12600d324a8cfd7352dd60aac Mon Sep 17 00:00:00 2001
>From: Hannes Reinecke <hare@suse.de>
>Date: Tue, 7 Apr 2015 11:29:48 +0200
>Subject: [PATCH] random-seed: accidental stack corruption
>
>struct rand_pool_info() specifies 'buf' as an array of length 0,
>so we need to allocate additional space to avoid an accidental
>stack corruption.
>
>Signed-off-by: Hannes Reinecke <hare@suse.de>
>---
> src/random-seed/random-seed.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
>diff --git a/src/random-seed/random-seed.c b/src/random-seed/random-seed.c
>index da31e6e..792e571 100644
>--- a/src/random-seed/random-seed.c
>+++ b/src/random-seed/random-seed.c
>@@ -134,12 +134,13 @@ int main(int argc, char *argv[]) {
>                         lseek(seed_fd, 0, SEEK_SET);
> 
>                         if (entropy_count && (size_t) k == buf_size) {
>-                                struct rand_pool_info entropy = {
>+                                struct rand_pool_info entropy_buf[2] = {
>                                         .entropy_count = entropy_count,
>                                         .buf_size = buf_size,
>                                 };
>-                                entropy.buf[0] = ((__u32*)buf)[0];
>-                                r = ioctl(random_fd, RNDADDENTROPY, &entropy);
>+                                struct rand_pool_info *entropy = entropy_buf[0];
>+                                entropy->buf[0] = ((__u32*)buf)[0];
>+                                r = ioctl(random_fd, RNDADDENTROPY, entropy);
>                                 if (r < 0) {
>                                         log_error("Failed to write seed to /dev/urandom: %m");
>                                         r = -errno;
>-- 
>1.8.4.5
>

Actions: View | Diff

Attachments on bug 926169: 630158 | 630231 | 630992