On 8/21/13 12:19 AM, Patrick Pelletier wrote:
Nikolay Elenkov wrote a proof-of-concept that shows the pid-wrapping bug
on Android, and then I took it one step further and wrote a
proof-of-concept using OpenSSL in C, demonstrating that this is an
underlying OpenSSL bug:
https://gist.github.com/ppelleti/6290984
Hmmm... so I'm able to reproduce the bug with my little program when
using the version of OpenSSL that ships with Ubuntu 12.04 (OpenSSL 1.0.1
14 Mar 2012). But I just built an OpenSSL off the tip of master in
github (OpenSSL 1.1.0-dev xx XXX xxxx), and my test program doesn't
produce any duplicate random numbers when linked against that OpenSSL.
So, this would suggest the bug has already been fixed, but I'm not sure
how, since md_rand.c hasn't been changed since 2011, and it's still
doing the same pid-mixing trick.
Anybody else have any observations or thoughts on this?
--Patrick
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager majord...@openssl.org
