Re: crash on solaris9/sparc with 4.1.31
Darren Reed <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.ipfilter |
|---|---|
| Message-ID | <15614_1229209911_49444137_15614_15996_1_49444022.7010003@reed.wattle.id.au> |
Chris, I added your problem here: https://sourceforge.net/tracker/index.php?func=detail&aid=2424604&group_id=169098&atid=849053 Then looked at the code and found a potential problem. Try the attached patch? Cheers, Darren
arc.patch
(text/plain, 1.9 KB)
Index: arc4random.c
===================================================================
RCS file: /devel/CVS/IP-Filter/arc4random.c,v
retrieving revision 1.1.2.4
diff -c -r1.1.2.4 arc4random.c
*** arc4random.c 26 Oct 2008 01:20:48 -0000 1.1.2.4
--- arc4random.c 13 Dec 2008 23:01:31 -0000
***************
*** 206,233 ****
#if defined(_SYS_MD5_H) && defined(SOLARIS2)
# define buf buf_un.buf8
#endif
while ((mylen > 64) && (sizeof(pot) - inpot > sizeof(md5ctx.buf))) {
MD5Update(&md5ctx, nsrc, 64);
mylen -= 64;
nsrc += 64;
- MUTEX_ENTER(&arc4_mtx);
if (pottail + sizeof(md5ctx.buf) > pot + sizeof(pot)) {
int left, numbytes;
numbytes = pot + sizeof(pot) - pottail;
bcopy(md5ctx.buf, pottail, numbytes);
! left -= numbytes;
pottail = pot;
! bcopy(md5ctx.buf + length - left, pottail, left);
pottail += left;
-
} else {
bcopy(md5ctx.buf, pottail, sizeof(md5ctx.buf));
pottail += sizeof(md5ctx.buf);
}
inpot += 64;
- MUTEX_EXIT(&arc4_mtx);
}
#if defined(_SYS_MD5_H) && defined(SOLARIS2)
# undef buf
#endif
--- 206,233 ----
#if defined(_SYS_MD5_H) && defined(SOLARIS2)
# define buf buf_un.buf8
#endif
+ MUTEX_ENTER(&arc4_mtx);
while ((mylen > 64) && (sizeof(pot) - inpot > sizeof(md5ctx.buf))) {
MD5Update(&md5ctx, nsrc, 64);
mylen -= 64;
nsrc += 64;
if (pottail + sizeof(md5ctx.buf) > pot + sizeof(pot)) {
int left, numbytes;
numbytes = pot + sizeof(pot) - pottail;
bcopy(md5ctx.buf, pottail, numbytes);
! left = sizeof(md5ctx.buf) - numbytes;
pottail = pot;
! bcopy(md5ctx.buf + sizeof(md5ctx.buf) - left,
! pottail, left);
pottail += left;
} else {
bcopy(md5ctx.buf, pottail, sizeof(md5ctx.buf));
pottail += sizeof(md5ctx.buf);
}
inpot += 64;
}
+ MUTEX_EXIT(&arc4_mtx);
#if defined(_SYS_MD5_H) && defined(SOLARIS2)
# undef buf
#endif