Messages in this thread | | | Date | Mon, 20 Oct 2014 10:16:35 -0400 | From | Theodore Ts'o <> | Subject | Re: drivers: random: Shift out-of-bounds in _mix_pool_bytes |
| |
On Mon, Oct 20, 2014 at 04:09:30PM +0200, Daniel Borkmann wrote: > > > >It's triggering when input_rotate == 0, so UBSan complains about right shift in rol32() > > > >static inline __u32 rol32(__u32 word, unsigned int shift) > >{ > > return (word << shift) | (word >> (32 - shift)); > >} > > So that would be the case when the entropy store's input_rotate calls > _mix_pool_bytes() for the very first time ... I don't think it's an > issue though.
I'm sure it's not an issue, but it's still true that
return (word << 0) | (word >> 32);
is technically not undefined, and while it would be unfortunate (and highly unlikely) if gcc were to say, start nethack, it's technically allowed by the C spec. :-)
- Ted
| |