Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-26 Thread Ruediger Pluem
Bojan Smojver wrote: On Thu, 2012-01-26 at 09:05 +1100, Bojan Smojver wrote: Will fix. Better? Yes. No more regression in httpd and APR tests pass as well. Regards RĂ¼diger

Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-25 Thread Ruediger Pluem
Bojan Smojver wrote: On Mon, 2012-01-16 at 14:11 +0100, Ruediger Pluem wrote: r1231605 and r1231858 cause massive regressions and test case failures in httpd. Not sure why right now. Could you please run your tests with this patch. Let me know how it goes. Thanks. I think there is

Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-25 Thread Bojan Smojver
--- Original message --- From: Ruediger Pluem Shouldn't you store the result of res-hash_func / apr_hashfunc_default_internal in a local temporary variable and use it later on? Otherwise you change the overlay hash and may make it unusable by setting a new hash value. IMHO all

Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-25 Thread Bojan Smojver
On Thu, 2012-01-26 at 09:05 +1100, Bojan Smojver wrote: Will fix. Better? -- Bojan Index: tables/apr_hash.c === --- tables/apr_hash.c (revision 1235978) +++ tables/apr_hash.c (working copy) @@ -18,6 +18,7 @@ #include

Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-22 Thread Bojan Smojver
On Mon, 2012-01-16 at 14:11 +0100, Ruediger Pluem wrote: r1231605 and r1231858 cause massive regressions and test case failures in httpd. Not sure why right now. Could you please run your tests with this patch. Let me know how it goes. Thanks. -- Bojan Index: tables/apr_hash.c

RE: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-16 Thread Bojan Smojver
On Sun, 2012-01-15 at 18:06 +0100, Bert Huijben wrote: If the timer has enough detail we could just use the time, ptr combination as the seed here. See whether you like r1231858. -- Bojan

Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-16 Thread Ruediger Pluem
Bojan Smojver wrote: On Sun, 2012-01-15 at 18:06 +0100, Bert Huijben wrote: If the timer has enough detail we could just use the time, ptr combination as the seed here. See whether you like r1231858. r1231605 and r1231858 cause massive regressions and test case failures in httpd. Not

Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-16 Thread Bojan Smojver
--- Original message --- From: Ruediger Pluem r1231605 and r1231858 cause massive regressions and test case failures in httpd. I won't be able to commit for a while. Please feel free to revert both. Sorry about the breakage. :-( -- Bojan

Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-16 Thread Bojan Smojver
--- Original message --- From: Bojan Smojver Sent: 17.1.'12, 5:18 --- Original message --- From: Ruediger Pluem r1231605 and r1231858 cause massive regressions and test case failures in httpd. I won't be able to commit for a while. Please feel free to revert both. Sorry

Re: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-16 Thread Bojan Smojver
--- Original message --- From: Bojan Smojver Sent: 17.1.'12, 5:18 --- Original message --- From: Ruediger Pluem r1231605 and r1231858 cause massive regressions and test case failures in httpd. I won't be able to commit for a while. Please feel free to revert both. Sorry

RE: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-15 Thread Bert Huijben
-Original Message- From: bo...@apache.org [mailto:bo...@apache.org] Sent: zondag 15 januari 2012 1:37 To: comm...@apr.apache.org Subject: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c Author: bojan Date: Sun Jan 15 00:37:14 2012 New Revision: 1231605 URL: http

RE: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-15 Thread Bojan Smojver
On Sun, 2012-01-15 at 18:06 +0100, Bert Huijben wrote: If you call srand() before every call to rand() the result is no longer random. Yes, I'm aware of that. And in this case we do this inside a shared library, so this might introduce other attack vectors in applications that use apr.

RE: svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c

2012-01-15 Thread Bojan Smojver
On Mon, 2012-01-16 at 08:38 +1100, Bojan Smojver wrote: That is true. In fact, my first code to the list just used ht. We could use ht and time to get random values. Same attack vectors as noted by you above apply, of course. Maybe like this? -- Bojan Index: tables/apr_hash.c