On 12/31/22 20:08, Alejandro Colomar wrote:
This makes the code much more readable and self-documented. While doing
this, I noticed a few bugs, and other cases which may be bugs or not.
Switching to this specialized API makes it easier to spot such bugs, but
since I'm not familiar with the code, I kept some bugs unfixed. The
most obvious ones (although I may be wrong) I fixed them. And in some
cases where it was very unclear, I didn't touch the old *_uniform() code.
Below are the cases where I changed the behavior (I considered it a bug):
* usr.bin/ssh/auth.c:
- *cp = hashchars[arc4random_uniform(sizeof(hashchars) - 1)];
+ *cp = hashchars[arc4random_range(0, sizeof(hashchars) - 1)];
Reconsidering, this one is probably better just as arc4random_uniform(sizeof(hashchars)).
* usr.sbin/ftp-proxy/ftp-proxy.c:
- return (IPPORT_HIFIRSTAUTO +
- arc4random_uniform(IPPORT_HILASTAUTO - IPPORT_HIFIRSTAUTO));
+ return arc4random_range(IPPORT_HIFIRSTAUTO, IPPORT_HILASTAUTO);
* usr.sbin/rad/engine.c:
- tv.tv_sec = MIN_RTR_ADV_INTERVAL +
- arc4random_uniform(MAX_RTR_ADV_INTERVAL - MIN_RTR_ADV_INTERVAL);
+ tv.tv_sec = arc4random_range(MIN_RTR_ADV_INTERVAL, MAX_RTR_ADV_INTERVAL);
In the following change, I didn't use the temporary variable 'num3'.
AFAICS, this doesn't affect other uses of the variable in other places,
because they set it before use. But please check carefully; I may have
missed something:
* usr.sbin/cron/entry.c:
- /* get a random number in the interval [num1, num2]
- */
- num3 = num1;
- num1 = arc4random_uniform(num2 - num3 + 1) + num3;
+ num1 = arc4random_range(num1, num2);
Signed-off-by: Alejandro Colomar <[email protected]>
-- <http://www.alejandro-colomar.es/>
OpenPGP_signature
Description: OpenPGP digital signature
