luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

socketpair: verify with a random value

Browse Source 
... instead of using the curl time struct, since it would use a few
uninitialized bytes and the sanitizers would complain. This is a neater
approach I think.

Reported-by: Boris Kuschel
Fixes #10993
Closes #11015
This commit is contained in:
Daniel Stenberg 2023-04-24 14:14:11 +02:00
parent 2079cb26a1
commit a97e4eb95f
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/rand.c
View File

@ -183,8 +183,8 @@ static CURLcode randit(struct Curl_easy *data, unsigned int *rnd)
}
/*
* Curl_rand() stores 'num' number of random unsigned integers in the buffer
* 'rndptr' points to.
* Curl_rand() stores 'num' number of random unsigned characters in the buffer
* 'rnd' points to.
*
* If libcurl is built without TLS support or with a TLS backend that lacks a
* proper random API (rustls, Gskit or mbedTLS), this function will use "weak"

14
lib/socketpair.c
View File

@ -24,6 +24,8 @@
#include "curl_setup.h"
#include "socketpair.h"
#include "urldata.h"
#include "rand.h"
#if !defined(HAVE_SOCKETPAIR) && !defined(CURL_DISABLE_SOCKETPAIR)
#ifdef WIN32
@ -125,13 +127,17 @@ int Curl_socketpair(int domain, int type, int protocol,
if(socks[1] == CURL_SOCKET_BAD)
goto error;
else {
struct curltime check;
struct curltime start = Curl_now();
char *p = (char *)✓
char rnd[9];
char check[sizeof(rnd)];
char *p = &check[0];
size_t s = sizeof(check);
if(Curl_rand(NULL, (unsigned char *)rnd, sizeof(rnd)))
goto error;
/* write data to the socket */
swrite(socks[0], &start, sizeof(start));
swrite(socks[0], rnd, sizeof(rnd));
/* verify that we read the correct data */
do {
ssize_t nread;
@ -168,7 +174,7 @@ int Curl_socketpair(int domain, int type, int protocol,
p += nread;
continue;
}
if(memcmp(&start, &check, sizeof(check)))
if(memcmp(rnd, check, sizeof(check)))
goto error;
break;
} while(1);