Re: OpenSSH/OpenSSL patches to stop excessive entropy consumption

On Sat, Mar 03, 2012 at 11:12:23PM -0500, Thor Lancelot Simon wrote:
> Sorry, something was wrong with that diff.  This one is right.

> -	arc4random_stir();
> -	arc4random_buf(rnd, sizeof(rnd));
> +	assert((read(urandom_fd, rnd, sizeof(rnd)) == sizeof(rnd)));

This is very bad idea to execute code as an assert() condition.
assert() is optional and if code is compiled with NDEBUG it will be
turned into no-op and in your case no random data will be read at all,
which makes this change dangerous.

-- 
Pawel Jakub Dawidek                       http://www.wheelsystems.com
FreeBSD committer                         http://www.FreeBSD.org
Am I Evil? Yes, I Am!                     http://tupytaj.pl

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk9TbDYACgkQForvXbEpPzRXjwCcCmgziSpUpoVJlMDXj2QEvLct
DLwAn3S5y0g8n3L/FsB1DWDKDv5QiLi3
=/PX6
-----END PGP SIGNATURE-----