Violating randomization standards

2014-12-08 Thread Theo de Raadt
I have spent the last week researching all the uses of the srand(), srandom(), and srand48() subsystems in the ports tree. These three APIs are standardized into C89, POSIX, XPG42, etc. Rather unfortunate, since they suck, and their existance suckers developers into doing the wrong thing. The

Re: Violating randomization standards

2014-12-08 Thread patrick keshishian
Hello, Small comment below. On Mon, Dec 08, 2014 at 01:55:47PM -0700, Theo de Raadt wrote: I have spent the last week researching all the uses of the srand(), srandom(), and srand48() subsystems in the ports tree. [...] RAND(3)Library Functions Manual

Re: Violating randomization standards

2014-12-08 Thread Jonas 'Sortie' Termansen
On 12/08/2014 09:55 PM, Theo de Raadt wrote: Index: lib/libc/stdlib/mrand48.c === RCS file: /cvs/src/lib/libc/stdlib/mrand48.c,v retrieving revision 1.3 diff -u -p -u -r1.3 mrand48.c --- lib/libc/stdlib/mrand48.c 8 Aug 2005

Re: Violating randomization standards

2014-12-08 Thread Todd C. Miller
On Tue, 09 Dec 2014 00:00:01 +0100, Jonas 'Sortie' Termansen wrote: POSIX says mrand48 is meant to return signed integers in the interval [-2^31,2^31), but this code returns an unsigned 32-bit integer value. Which gets cast to a signed integer in that same range... - todd

Re: Violating randomization standards

2014-12-08 Thread Jonas 'Sortie' Termansen
On 12/09/2014 12:06 AM, Todd C. Miller wrote: Which gets cast to a signed integer in that same range... Except long is larger than 32 bits on 64-bit platforms.

Re: Violating randomization standards

2014-12-08 Thread Ted Unangst
On Tue, Dec 09, 2014 at 00:00, Jonas 'Sortie' Termansen wrote: On 12/08/2014 09:55 PM, Theo de Raadt wrote: Index: lib/libc/stdlib/mrand48.c === RCS file: /cvs/src/lib/libc/stdlib/mrand48.c,v retrieving revision 1.3 diff -u -p