crypto/rand/rand_unix.c:208: error: BUFFER_OVERRUN_L3
  Offset: [12, 17] Size: [13, 18] by call to `RAND_query_egd_bytes`.
Showing all 7 steps of the trace


crypto/rand/rand_unix.c:142:36: Array declaration
140.   #endif
141.   #ifdef DEVRANDOM_EGD
142.   	static const char *egdsockets[] = { DEVRANDOM_EGD, NULL };
                                          ^
143.   	const char **egdsocket = NULL;
144.   #endif

crypto/rand/rand_unix.c:208:7: Call
206.   		int r;
207.   
208.   		r = RAND_query_egd_bytes(*egdsocket, (unsigned char *)tmpbuf+n,
             ^
209.   					 ENTROPY_NEEDED-n);
210.   		if (r > 0)

crypto/rand/rand_egd.c:135:1: <Offset trace>
133.   #endif
134.   
135. > int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
136.   	{
137.   	int ret = 0;

crypto/rand/rand_egd.c:135:1: Parameter `path->strlen`
  133.   #endif
  134.   
  135. > int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
  136.   	{
  137.   	int ret = 0;

crypto/rand/rand_egd.c:135:1: <Length trace>
133.   #endif
134.   
135. > int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
136.   	{
137.   	int ret = 0;

crypto/rand/rand_egd.c:135:1: Parameter `*path`
  133.   #endif
  134.   
  135. > int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
  136.   	{
  137.   	int ret = 0;

crypto/rand/rand_egd.c:148:2: Array access: Offset: [12, 17] Size: [13, 18] by call to `RAND_query_egd_bytes` 
  146.   	if (strlen(path) >= sizeof(addr.sun_path))
  147.   		return (-1);
  148.   	strcpy(addr.sun_path,path);
          ^
  149.   	len = offsetof(struct sockaddr_un, sun_path) + strlen(path);
  150.   	fd = socket(AF_UNIX, SOCK_STREAM, 0);

int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
	{
	int ret = 0;
	struct sockaddr_un addr;
	int len, num, numbytes;
	int fd = -1;
	int success;
	unsigned char egdbuf[2], tempbuf[255], *retrievebuf;
	memset(&addr, 0, sizeof(addr));
	addr.sun_family = AF_UNIX;
	if (strlen(path) >= sizeof(addr.sun_path))
		return (-1);
	strcpy(addr.sun_path,path);
	len = offsetof(struct sockaddr_un, sun_path) + strlen(path);
	fd = socket(AF_UNIX, SOCK_STREAM, 0);
	if (fd == -1) return (-1);
	success = 0;
	while (!success)
	    {
	    if (connect(fd, (struct sockaddr *)&addr, len) == 0)
	       success = 1;
	    else
		{
		switch (errno)
		    {
#ifdef EINTR
		    case EINTR:
#endif
#ifdef EAGAIN
		    case EAGAIN:
#endif
#ifdef EINPROGRESS
		    case EINPROGRESS:
#endif
#ifdef EALREADY
		    case EALREADY:
#endif
			break;
#ifdef EISCONN
		    case EISCONN:
			success = 1;
			break;
#endif
		    default:
			goto err;
		    }
		}
	    }
	while(bytes > 0)
	    {
	    egdbuf[0] = 1;
	    egdbuf[1] = bytes < 255 ? bytes : 255;
	    numbytes = 0;
	    while (numbytes != 2)
		{
	        num = write(fd, egdbuf + numbytes, 2 - numbytes);
	        if (num >= 0)
		    numbytes += num;
	    	else
		    {
		    switch (errno)
		    	{
#ifdef EINTR
		    	case EINTR:
#endif
#ifdef EAGAIN
		    	case EAGAIN:
#endif
			    break;
		    	default:
			    ret = -1;
			    goto err;
			}
		    }
		}
	    numbytes = 0;
	    while (numbytes != 1)
		{
	        num = read(fd, egdbuf, 1);
	        if (num >= 0)
		    numbytes += num;
	    	else
		    {
		    switch (errno)
		    	{
#ifdef EINTR
		    	case EINTR:
#endif
#ifdef EAGAIN
		    	case EAGAIN:
#endif
			    break;
		    	default:
			    ret = -1;
			    goto err;
			}
		    }
		}
	    if(egdbuf[0] == 0)
		goto err;
	    if (buf)
		retrievebuf = buf + ret;
	    else
		retrievebuf = tempbuf;
	    numbytes = 0;
	    while (numbytes != egdbuf[0])
		{
	        num = read(fd, retrievebuf + numbytes, egdbuf[0] - numbytes);
	        if (num >= 0)
		    numbytes += num;
	    	else
		    {
		    switch (errno)
		    	{
#ifdef EINTR
		    	case EINTR:
#endif
#ifdef EAGAIN
		    	case EAGAIN:
#endif
			    break;
		    	default:
			    ret = -1;
			    goto err;
			}
		    }
		}
	    ret += egdbuf[0];
	    bytes -= egdbuf[0];
	    if (!buf)
		RAND_seed(tempbuf, egdbuf[0]);
	    }
 err:
	if (fd != -1) close(fd);
	return(ret);
	}
['int RAND_poll(void)\n{\n\tunsigned long l;\n\tpid_t curr_pid = getpid();\n#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)\n\tunsigned char tmpbuf[ENTROPY_NEEDED];\n\tint n = 0;\n#endif\n#ifdef DEVRANDOM\n\tstatic const char *randomfiles[] = { DEVRANDOM, NULL };\n\tconst char **randomfile = NULL;\n\tint fd;\n#endif\n#ifdef DEVRANDOM_EGD\n\tstatic const char *egdsockets[] = { DEVRANDOM_EGD, NULL };\n\tconst char **egdsocket = NULL;\n#endif\n#ifdef DEVRANDOM\n\tfor (randomfile = randomfiles; *randomfile && n < ENTROPY_NEEDED; randomfile++)\n\t\t{\n\t\tif ((fd = open(*randomfile, O_RDONLY|O_NONBLOCK\n#ifdef O_NOCTTY\n\t\t\t|O_NOCTTY\n#endif\n#ifdef O_NOFOLLOW\n\t\t\t|O_NOFOLLOW\n#endif\n\t\t\t)) >= 0)\n\t\t\t{\n\t\t\tstruct timeval t = { 0, 10*1000 };\n\t\t\tint r;\n\t\t\tfd_set fset;\n\t\t\tdo\n\t\t\t\t{\n\t\t\t\tFD_ZERO(&fset);\n\t\t\t\tFD_SET(fd, &fset);\n\t\t\t\tr = -1;\n\t\t\t\tif (select(fd+1,&fset,NULL,NULL,&t) < 0)\n\t\t\t\t\tt.tv_usec=0;\n\t\t\t\telse if (FD_ISSET(fd, &fset))\n\t\t\t\t\t{\n\t\t\t\t\tr=read(fd,(unsigned char *)tmpbuf+n,\n\t\t\t\t\t       ENTROPY_NEEDED-n);\n\t\t\t\t\tif (r > 0)\n\t\t\t\t\t\tn += r;\n\t\t\t\t\t}\n\t\t\t\tif (t.tv_usec == 10*1000)\n\t\t\t\t\tt.tv_usec=0;\n\t\t\t\t}\n\t\t\twhile ((r > 0 || (errno == EINTR || errno == EAGAIN))\n\t\t\t\t&& t.tv_usec != 0 && n < ENTROPY_NEEDED);\n\t\t\tclose(fd);\n\t\t\t}\n\t\t}\n#endif\n#ifdef DEVRANDOM_EGD\n\tfor (egdsocket = egdsockets; *egdsocket && n < ENTROPY_NEEDED; egdsocket++)\n\t\t{\n\t\tint r;\n\t\tr = RAND_query_egd_bytes(*egdsocket, (unsigned char *)tmpbuf+n,\n\t\t\t\t\t ENTROPY_NEEDED-n);\n\t\tif (r > 0)\n\t\t\tn += r;\n\t\t}\n#endif\n#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)\n\tif (n > 0)\n\t\t{\n\t\tRAND_add(tmpbuf,sizeof tmpbuf,n);\n\t\tOPENSSL_cleanse(tmpbuf,n);\n\t\t}\n#endif\n\tl=curr_pid;\n\tRAND_add(&l,sizeof(l),0);\n\tl=getuid();\n\tRAND_add(&l,sizeof(l),0);\n\tl=time(NULL);\n\tRAND_add(&l,sizeof(l),0);\n#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)\n\treturn 1;\n#else\n\treturn 0;\n#endif\n}', 'int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)\n\t{\n\tint ret = 0;\n\tstruct sockaddr_un addr;\n\tint len, num, numbytes;\n\tint fd = -1;\n\tint success;\n\tunsigned char egdbuf[2], tempbuf[255], *retrievebuf;\n\tmemset(&addr, 0, sizeof(addr));\n\taddr.sun_family = AF_UNIX;\n\tif (strlen(path) >= sizeof(addr.sun_path))\n\t\treturn (-1);\n\tstrcpy(addr.sun_path,path);\n\tlen = offsetof(struct sockaddr_un, sun_path) + strlen(path);\n\tfd = socket(AF_UNIX, SOCK_STREAM, 0);\n\tif (fd == -1) return (-1);\n\tsuccess = 0;\n\twhile (!success)\n\t    {\n\t    if (connect(fd, (struct sockaddr *)&addr, len) == 0)\n\t       success = 1;\n\t    else\n\t\t{\n\t\tswitch (errno)\n\t\t    {\n#ifdef EINTR\n\t\t    case EINTR:\n#endif\n#ifdef EAGAIN\n\t\t    case EAGAIN:\n#endif\n#ifdef EINPROGRESS\n\t\t    case EINPROGRESS:\n#endif\n#ifdef EALREADY\n\t\t    case EALREADY:\n#endif\n\t\t\tbreak;\n#ifdef EISCONN\n\t\t    case EISCONN:\n\t\t\tsuccess = 1;\n\t\t\tbreak;\n#endif\n\t\t    default:\n\t\t\tgoto err;\n\t\t    }\n\t\t}\n\t    }\n\twhile(bytes > 0)\n\t    {\n\t    egdbuf[0] = 1;\n\t    egdbuf[1] = bytes < 255 ? bytes : 255;\n\t    numbytes = 0;\n\t    while (numbytes != 2)\n\t\t{\n\t        num = write(fd, egdbuf + numbytes, 2 - numbytes);\n\t        if (num >= 0)\n\t\t    numbytes += num;\n\t    \telse\n\t\t    {\n\t\t    switch (errno)\n\t\t    \t{\n#ifdef EINTR\n\t\t    \tcase EINTR:\n#endif\n#ifdef EAGAIN\n\t\t    \tcase EAGAIN:\n#endif\n\t\t\t    break;\n\t\t    \tdefault:\n\t\t\t    ret = -1;\n\t\t\t    goto err;\n\t\t\t}\n\t\t    }\n\t\t}\n\t    numbytes = 0;\n\t    while (numbytes != 1)\n\t\t{\n\t        num = read(fd, egdbuf, 1);\n\t        if (num >= 0)\n\t\t    numbytes += num;\n\t    \telse\n\t\t    {\n\t\t    switch (errno)\n\t\t    \t{\n#ifdef EINTR\n\t\t    \tcase EINTR:\n#endif\n#ifdef EAGAIN\n\t\t    \tcase EAGAIN:\n#endif\n\t\t\t    break;\n\t\t    \tdefault:\n\t\t\t    ret = -1;\n\t\t\t    goto err;\n\t\t\t}\n\t\t    }\n\t\t}\n\t    if(egdbuf[0] == 0)\n\t\tgoto err;\n\t    if (buf)\n\t\tretrievebuf = buf + ret;\n\t    else\n\t\tretrievebuf = tempbuf;\n\t    numbytes = 0;\n\t    while (numbytes != egdbuf[0])\n\t\t{\n\t        num = read(fd, retrievebuf + numbytes, egdbuf[0] - numbytes);\n\t        if (num >= 0)\n\t\t    numbytes += num;\n\t    \telse\n\t\t    {\n\t\t    switch (errno)\n\t\t    \t{\n#ifdef EINTR\n\t\t    \tcase EINTR:\n#endif\n#ifdef EAGAIN\n\t\t    \tcase EAGAIN:\n#endif\n\t\t\t    break;\n\t\t    \tdefault:\n\t\t\t    ret = -1;\n\t\t\t    goto err;\n\t\t\t}\n\t\t    }\n\t\t}\n\t    ret += egdbuf[0];\n\t    bytes -= egdbuf[0];\n\t    if (!buf)\n\t\tRAND_seed(tempbuf, egdbuf[0]);\n\t    }\n err:\n\tif (fd != -1) close(fd);\n\treturn(ret);\n\t}']