Date: Fri, 6 Aug 2021 05:13:33 GMT From: "David E. O'Brien" <obrien@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 8eb54646dd0e - stable/12 - Fortuna: fix a correctness issue in reseed (fortuna_pre_read) Message-ID: <202108060513.1765DXJi000894@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by obrien: URL: https://cgit.FreeBSD.org/src/commit/?id=8eb54646dd0eabd66c70f152b502412c04766fdf commit 8eb54646dd0eabd66c70f152b502412c04766fdf Author: Conrad Meyer <cem@FreeBSD.org> AuthorDate: 2018-10-26 20:55:01 +0000 Commit: David E. O'Brien <obrien@FreeBSD.org> CommitDate: 2021-08-06 05:12:05 +0000 Fortuna: fix a correctness issue in reseed (fortuna_pre_read) 'i' counts the number of pools included in the array 's'. Passing 'i+1' to reseed_internal() as the number of blocks in 's' is a bogus overrun of the initialized portion of 's' -- technically UB. I found this via code inspection, referencing ยง9.5.2 "Pools" of the Fortuna chapter, but I would expect Coverity to notice the same issue. Unfortunately, it doesn't appear to. Reviewed by: markm Approved by: secteam (gordon) Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D16985 (cherry picked from commit 9a88479843e2314018f66fd2cdad5ae0200393d0) --- sys/dev/random/fortuna.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/dev/random/fortuna.c b/sys/dev/random/fortuna.c index f9a29fd5a596..0eaffa1de439 100644 --- a/sys/dev/random/fortuna.c +++ b/sys/dev/random/fortuna.c @@ -408,7 +408,7 @@ random_fortuna_pre_read(void) SDT_PROBE2(random, fortuna, event_processor, debug, fortuna_state.fs_reseedcount, fortuna_state.fs_pool); #endif /* FS&K */ - random_fortuna_reseed_internal(s, i < RANDOM_FORTUNA_NPOOLS ? i + 1 : RANDOM_FORTUNA_NPOOLS); + random_fortuna_reseed_internal(s, i); /* Clean up and secure */ explicit_bzero(s, sizeof(s)); explicit_bzero(temp, sizeof(temp));
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202108060513.1765DXJi000894>