Rename our getentropy to prevent possible loops.

Since arc4random seeds from getentropy, and we use OpenSSL for that
if enabled, there's the possibility that if we build on a system that
does not have getentropy then run on a system that does have it, then
OpenSSL could end up calling our getentropy and getting stuck in a loop.
Pointed out by deraadt@, ok djm@
This commit is contained in:
Darren Tucker 2022-08-10 17:25:24 +10:00
parent 7a01f61be8
commit 7e2f51940b
3 changed files with 11 additions and 2 deletions

View File

@ -35,6 +35,15 @@
#ifndef HAVE_ARC4RANDOM
/*
* If we're not using a native getentropy, use the one from bsd-getentropy.c
* under a different name, so that if in future these binaries are run on
* a system that has a native getentropy OpenSSL cannot call the wrong one.
*/
#ifndef HAVE_GETENTROPY
# define getentropy(x, y) (_ssh_compat_getentropy((x), (y)))
#endif
#define MINIMUM(a, b) (((a) < (b)) ? (a) : (b))
#include "log.h"

View File

@ -41,7 +41,7 @@
#include "log.h"
int
getentropy(void *s, size_t len)
_ssh_compat_getentropy(void *s, size_t len)
{
#ifdef WITH_OPENSSL
if (RAND_bytes(s, len) <= 0)

View File

@ -70,7 +70,7 @@ int ftruncate(int filedes, off_t length);
#endif
#if defined(HAVE_DECL_GETENTROPY) && HAVE_DECL_GETENTROPY == 0
int getentropy(void *, size_t);
int _ssh_compat_getentropy(void *, size_t);
#endif
#ifndef HAVE_GETLINE