crypto/rand/rand_unix.c:204: error: BUFFER_OVERRUN_L3
  Offset: [12, 17] Size: [13, 18] by call to `RAND_query_egd_bytes`.
Showing all 7 steps of the trace


crypto/rand/rand_unix.c:138:36: Array declaration
136.   #endif
137.   #ifdef DEVRANDOM_EGD
138.   	static const char *egdsockets[] = { DEVRANDOM_EGD, NULL };
                                          ^
139.   	const char **egdsocket = NULL;
140.   #endif

crypto/rand/rand_unix.c:204:7: Call
202.   		int r;
203.   
204.   		r = RAND_query_egd_bytes(*egdsocket, (unsigned char *)tmpbuf+n,
             ^
205.   					 ENTROPY_NEEDED-n);
206.   		if (r > 0)

crypto/rand/rand_egd.c:88:1: <Offset trace>
86.   #endif
87.   
88. > int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
89.   	{
90.   	int ret = 0;

crypto/rand/rand_egd.c:88:1: Parameter `path->strlen`
  86.   #endif
  87.   
  88. > int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
  89.   	{
  90.   	int ret = 0;

crypto/rand/rand_egd.c:88:1: <Length trace>
86.   #endif
87.   
88. > int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
89.   	{
90.   	int ret = 0;

crypto/rand/rand_egd.c:88:1: Parameter `*path`
  86.   #endif
  87.   
  88. > int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
  89.   	{
  90.   	int ret = 0;

crypto/rand/rand_egd.c:100:2: Array access: Offset: [12, 17] Size: [13, 18] by call to `RAND_query_egd_bytes` 
  98.   	if (strlen(path) > sizeof(addr.sun_path))
  99.   		return (-1);
  100.   	strcpy(addr.sun_path,path);
          ^
  101.   	len = offsetof(struct sockaddr_un, sun_path) + strlen(path);
  102.   	fd = socket(AF_UNIX, SOCK_STREAM, 0);

int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)
	{
	int ret = 0;
	struct sockaddr_un addr;
	int len, num;
	int fd = -1;
	unsigned char egdbuf[2];
	memset(&addr, 0, sizeof(addr));
	addr.sun_family = AF_UNIX;
	if (strlen(path) > sizeof(addr.sun_path))
		return (-1);
	strcpy(addr.sun_path,path);
	len = offsetof(struct sockaddr_un, sun_path) + strlen(path);
	fd = socket(AF_UNIX, SOCK_STREAM, 0);
	if (fd == -1) return (-1);
	if (connect(fd, (struct sockaddr *)&addr, len) == -1) goto err;
	while(bytes > 0)
	    {
	    egdbuf[0] = 1;
	    egdbuf[1] = bytes < 255 ? bytes : 255;
	    write(fd, egdbuf, 2);
	    if (read(fd, egdbuf, 1) != 1)
		{
		ret=-1;
		goto err;
		}
	    if(egdbuf[0] == 0)
		goto err;
	    num = read(fd, buf + ret, egdbuf[0]);
	    if (num < 1)
		{
		ret=-1;
		goto err;
		}
	    ret += num;
	    bytes-=num;
	    }
 err:
	if (fd != -1) close(fd);
	return(ret);
	}
['int RAND_poll(void)\n{\n\tunsigned long l;\n\tpid_t curr_pid = getpid();\n#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)\n\tunsigned char tmpbuf[ENTROPY_NEEDED];\n\tint n = 0;\n#endif\n#ifdef DEVRANDOM\n\tstatic const char *randomfiles[] = { DEVRANDOM, NULL };\n\tconst char **randomfile = NULL;\n\tint fd;\n#endif\n#ifdef DEVRANDOM_EGD\n\tstatic const char *egdsockets[] = { DEVRANDOM_EGD, NULL };\n\tconst char **egdsocket = NULL;\n#endif\n#ifdef DEVRANDOM\n\tfor (randomfile = randomfiles; *randomfile && n < ENTROPY_NEEDED; randomfile++)\n\t\t{\n\t\tif ((fd = open(*randomfile, O_RDONLY|O_NONBLOCK\n#ifdef O_NOCTTY\n\t\t\t|O_NOCTTY\n#endif\n#ifdef O_NOFOLLOW\n\t\t\t|O_NOFOLLOW\n#endif\n\t\t\t)) >= 0)\n\t\t\t{\n\t\t\tstruct timeval t = { 0, 10*1000 };\n\t\t\tint r;\n\t\t\tfd_set fset;\n\t\t\tdo\n\t\t\t\t{\n\t\t\t\tFD_ZERO(&fset);\n\t\t\t\tFD_SET(fd, &fset);\n\t\t\t\tr = -1;\n\t\t\t\tif (select(fd+1,&fset,NULL,NULL,&t) < 0)\n\t\t\t\t\tt.tv_usec=0;\n\t\t\t\telse if (FD_ISSET(fd, &fset))\n\t\t\t\t\t{\n\t\t\t\t\tr=read(fd,(unsigned char *)tmpbuf+n,\n\t\t\t\t\t       ENTROPY_NEEDED-n);\n\t\t\t\t\tif (r > 0)\n\t\t\t\t\t\tn += r;\n\t\t\t\t\t}\n\t\t\t\tif (t.tv_usec == 10*1000)\n\t\t\t\t\tt.tv_usec=0;\n\t\t\t\t}\n\t\t\twhile ((r > 0 || (errno == EINTR || errno == EAGAIN))\n\t\t\t\t&& t.tv_usec != 0 && n < ENTROPY_NEEDED);\n\t\t\tclose(fd);\n\t\t\t}\n\t\t}\n#endif\n#ifdef DEVRANDOM_EGD\n\tfor (egdsocket = egdsockets; *egdsocket && n < ENTROPY_NEEDED; egdsocket++)\n\t\t{\n\t\tint r;\n\t\tr = RAND_query_egd_bytes(*egdsocket, (unsigned char *)tmpbuf+n,\n\t\t\t\t\t ENTROPY_NEEDED-n);\n\t\tif (r > 0)\n\t\t\tn += r;\n\t\t}\n#endif\n#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)\n\tif (n > 0)\n\t\t{\n\t\tRAND_add(tmpbuf,sizeof tmpbuf,n);\n\t\tmemset(tmpbuf,0,n);\n\t\t}\n#endif\n\tl=curr_pid;\n\tRAND_add(&l,sizeof(l),0);\n\tl=getuid();\n\tRAND_add(&l,sizeof(l),0);\n\tl=time(NULL);\n\tRAND_add(&l,sizeof(l),0);\n#if defined(DEVRANDOM) || defined(DEVRANDOM_EGD)\n\treturn 1;\n#endif\n\treturn 0;\n}', 'int RAND_query_egd_bytes(const char *path, unsigned char *buf, int bytes)\n\t{\n\tint ret = 0;\n\tstruct sockaddr_un addr;\n\tint len, num;\n\tint fd = -1;\n\tunsigned char egdbuf[2];\n\tmemset(&addr, 0, sizeof(addr));\n\taddr.sun_family = AF_UNIX;\n\tif (strlen(path) > sizeof(addr.sun_path))\n\t\treturn (-1);\n\tstrcpy(addr.sun_path,path);\n\tlen = offsetof(struct sockaddr_un, sun_path) + strlen(path);\n\tfd = socket(AF_UNIX, SOCK_STREAM, 0);\n\tif (fd == -1) return (-1);\n\tif (connect(fd, (struct sockaddr *)&addr, len) == -1) goto err;\n\twhile(bytes > 0)\n\t    {\n\t    egdbuf[0] = 1;\n\t    egdbuf[1] = bytes < 255 ? bytes : 255;\n\t    write(fd, egdbuf, 2);\n\t    if (read(fd, egdbuf, 1) != 1)\n\t\t{\n\t\tret=-1;\n\t\tgoto err;\n\t\t}\n\t    if(egdbuf[0] == 0)\n\t\tgoto err;\n\t    num = read(fd, buf + ret, egdbuf[0]);\n\t    if (num < 1)\n\t\t{\n\t\tret=-1;\n\t\tgoto err;\n\t\t}\n\t    ret += num;\n\t    bytes-=num;\n\t    }\n err:\n\tif (fd != -1) close(fd);\n\treturn(ret);\n\t}']