Chris,

I added your problem here:
https://sourceforge.net/tracker/index.php?func=detail&aid=2424604&group_id=169098&atid=849053

Then looked at the code and found a potential problem.

Try the attached patch?

Cheers,
Darren

Index: arc4random.c
===================================================================
RCS file: /devel/CVS/IP-Filter/arc4random.c,v
retrieving revision 1.1.2.4
diff -c -r1.1.2.4 arc4random.c
*** arc4random.c        26 Oct 2008 01:20:48 -0000      1.1.2.4
--- arc4random.c        13 Dec 2008 23:01:31 -0000
***************
*** 206,233 ****
  #if defined(_SYS_MD5_H) && defined(SOLARIS2)
  # define      buf     buf_un.buf8
  #endif
        while ((mylen > 64)  && (sizeof(pot) - inpot > sizeof(md5ctx.buf))) {
                MD5Update(&md5ctx, nsrc, 64);
                mylen -= 64;
                nsrc += 64;
-               MUTEX_ENTER(&arc4_mtx);
                if (pottail + sizeof(md5ctx.buf) > pot + sizeof(pot)) {
                        int left, numbytes;
  
                        numbytes = pot + sizeof(pot) - pottail;
                        bcopy(md5ctx.buf, pottail, numbytes);
!                       left -= numbytes;
                        pottail = pot;
!                       bcopy(md5ctx.buf + length - left, pottail, left);
                        pottail += left;
-                       
                } else {
                        bcopy(md5ctx.buf, pottail, sizeof(md5ctx.buf));
                        pottail += sizeof(md5ctx.buf);
                }
                inpot += 64;
-               MUTEX_EXIT(&arc4_mtx);
        }
  #if defined(_SYS_MD5_H) && defined(SOLARIS2)
  # undef buf
  #endif
--- 206,233 ----
  #if defined(_SYS_MD5_H) && defined(SOLARIS2)
  # define      buf     buf_un.buf8
  #endif
+       MUTEX_ENTER(&arc4_mtx);
        while ((mylen > 64)  && (sizeof(pot) - inpot > sizeof(md5ctx.buf))) {
                MD5Update(&md5ctx, nsrc, 64);
                mylen -= 64;
                nsrc += 64;
                if (pottail + sizeof(md5ctx.buf) > pot + sizeof(pot)) {
                        int left, numbytes;
  
                        numbytes = pot + sizeof(pot) - pottail;
                        bcopy(md5ctx.buf, pottail, numbytes);
!                       left = sizeof(md5ctx.buf) - numbytes;
                        pottail = pot;
!                       bcopy(md5ctx.buf + sizeof(md5ctx.buf) - left,
!                             pottail, left);
                        pottail += left;
                } else {
                        bcopy(md5ctx.buf, pottail, sizeof(md5ctx.buf));
                        pottail += sizeof(md5ctx.buf);
                }
                inpot += 64;
        }
+       MUTEX_EXIT(&arc4_mtx);
  #if defined(_SYS_MD5_H) && defined(SOLARIS2)
  # undef buf
  #endif

Reply via email to