c-ares

220 Commits

14 Branches

97 Tags

23 MiB

Tag: Branch: Tree: 6360e96b5c

Commit Graph

Author	SHA1	Message	Date
Brad House	823df3b989	Merge pull request from GHSA-8r8p-23f3-64c2 * segment random number generation into own file * abstract random code to make it more modular so we can have multiple backends * rand: add support for arc4random_buf() and also direct CARES_RANDOM_FILE reading * autotools: fix detection of arc4random_buf * rework initial rc4 seed for PRNG as last fallback * rc4: more proper implementation, simplified for clarity * clarifications	2 years ago
Fionn Fitzmaurice	6d6cd5daf6	Avoid buffer overflow in RC4 loop comparison (#336 ) The rc4 function iterates over a buffer of size buffer_len who's maximum value is INT_MAX with a counter of type short that is not guaranteed to have maximum size INT_MAX. In circumstances where short is narrower than int and where buffer_len is larger than the maximum value of a short, it may be possible to loop infinitely as counter will overflow and never be greater than or equal to buffer_len. The solution is to make the comparison be between types of equal width. This commit defines counter as an int. Fix By: Fionn Fitzmaurice (@fionn)	5 years ago

Author

SHA1

Message

Date

Brad House

823df3b989

Merge pull request from GHSA-8r8p-23f3-64c2

* segment random number generation into own file

* abstract random code to make it more modular so we can have multiple backends

* rand: add support for arc4random_buf() and also direct CARES_RANDOM_FILE reading

* autotools: fix detection of arc4random_buf

* rework initial rc4 seed for PRNG as last fallback

* rc4: more proper implementation, simplified for clarity

* clarifications

2 years ago

Fionn Fitzmaurice

6d6cd5daf6

Avoid buffer overflow in RC4 loop comparison (#336 )

The rc4 function iterates over a buffer of size buffer_len who's maximum
value is INT_MAX with a counter of type short that is not guaranteed to
have maximum size INT_MAX.

In circumstances where short is narrower than int and where buffer_len
is larger than the maximum value of a short, it may be possible to loop
infinitely as counter will overflow and never be greater than or equal
to buffer_len.

The solution is to make the comparison be between types of equal width.
This commit defines counter as an int.

Fix By: Fionn Fitzmaurice (@fionn)

5 years ago

2 Commits (6360e96b5cf8e5980c887ce58ef727e53d77243a)