Просмотр исходного кода

crypto: rng_make_prng prevent buf overflow

with bits set to 1023, buf of 256 bytes was filled by rng_get_bytes
up to 257 bytes. Buf is now 258 bytes so it's no longer problem.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Steven Dake <sdake@redhat.com>
(cherry picked from commit 50f05bfa15622e10f58511e8b0b8dadfe670e12f)
Jan Friesse 14 лет назад
Родитель
Сommit
c904143aa8
1 измененных файлов с 1 добавлено и 1 удалено
  1. 1 1
      exec/crypto.c

+ 1 - 1
exec/crypto.c

@@ -1314,7 +1314,7 @@ unsigned long rng_get_bytes(unsigned char *buf, unsigned long len,
 int rng_make_prng(int bits, int wprng, prng_state *prng,
 int rng_make_prng(int bits, int wprng, prng_state *prng,
                   void (*callback)(void))
                   void (*callback)(void))
 {
 {
-   unsigned char buf[256];
+   unsigned char buf[258];
    int err;
    int err;
 
 
    if (bits < 64 || bits > 1024) {
    if (bits < 64 || bits > 1024) {