|
 |
630768 |
From 9f6fbc0d4d4fd12d51ae8e9ac4152bc0bc835c24 Mon Sep 17 00:00:00 2001
|
|
|
630768 |
Message-Id: <9f6fbc0d4d4fd12d51ae8e9ac4152bc0bc835c24@dist-git>
|
|
|
630768 |
From: Michal Privoznik <mprivozn@redhat.com>
|
|
|
630768 |
Date: Mon, 21 Jan 2019 09:04:10 -0500
|
|
|
630768 |
Subject: [PATCH] util: Don't overflow in virRandomBits
|
|
|
630768 |
MIME-Version: 1.0
|
|
|
630768 |
Content-Type: text/plain; charset=UTF-8
|
|
|
630768 |
Content-Transfer-Encoding: 8bit
|
|
|
630768 |
|
|
|
630768 |
https://bugzilla.redhat.com/show_bug.cgi?id=1667329 (RHEL 7.6.z)
|
|
|
630768 |
https://bugzilla.redhat.com/show_bug.cgi?id=1652894 (RHEL 7.7)
|
|
|
630768 |
|
|
|
630768 |
The function is supposed to return up to 64bit long integer. In
|
|
|
630768 |
order to do that it calls virRandomBytes() to fill the integer
|
|
|
630768 |
with random bytes and then masks out everything but requested
|
|
|
630768 |
bits. However, when doing that it shifts 1U and not 1ULL. So
|
|
|
630768 |
effectively, requesting 32 random bis or more always return 0
|
|
|
630768 |
which is not random enough.
|
|
|
630768 |
|
|
|
630768 |
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
|
630768 |
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
|
630768 |
Reviewed-by: Pino Toscano <ptoscano@redhat.com>
|
|
|
630768 |
(cherry picked from commit 78c47a92ecb450c9f8bcabd35da7006dc2547882)
|
|
|
630768 |
Signed-off-by: John Ferlan <jferlan@redhat.com>
|
|
|
630768 |
Message-Id: <20190121140412.27804-2-jferlan@redhat.com>
|
|
|
630768 |
Reviewed-by: Erik Skultety <eskultet@redhat.com>
|
|
|
630768 |
---
|
|
|
630768 |
src/util/virrandom.c | 2 +-
|
|
|
630768 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
630768 |
|
|
|
630768 |
diff --git a/src/util/virrandom.c b/src/util/virrandom.c
|
|
|
630768 |
index 01cc82a052..3c011a8615 100644
|
|
|
630768 |
--- a/src/util/virrandom.c
|
|
|
630768 |
+++ b/src/util/virrandom.c
|
|
|
630768 |
@@ -68,7 +68,7 @@ uint64_t virRandomBits(int nbits)
|
|
|
630768 |
return 0;
|
|
|
630768 |
}
|
|
|
630768 |
|
|
|
630768 |
- ret &= (1U << nbits) - 1;
|
|
|
630768 |
+ ret &= (1ULL << nbits) - 1;
|
|
|
630768 |
return ret;
|
|
|
630768 |
}
|
|
|
630768 |
|
|
|
630768 |
--
|
|
|
630768 |
2.20.1
|
|
|
630768 |
|