⬢ DragonFlyBSD Kernel Audit
DF-5708 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/libkern/random.c b/sys/libkern/random.c
index dbe4631..2d85f47 100644
--- a/sys/libkern/random.c
+++ b/sys/libkern/random.c
@@ -38,7 +38,12 @@ static u_long randseed = 1;
 void
 skrandom(u_long seed)
 {
-	randseed = seed;
+	/* Keep the state inside the MINSTD domain [1, 2^31 - 2].
+	 * Seeds congruent to 0 mod (2^31 - 1) -- including 0, 2^31 - 1 and
+	 * 2*(2^31 - 1), all of which skrandom(karc4random()) can produce --
+	 * otherwise park the generator on an absorbing fixed point that
+	 * returns the constant 0x7fffffff to every consumer, forever. */
+	randseed = seed % 0x7ffffffeUL + 1;
 }
 
 /*
@@ -57,6 +62,8 @@ krandom(void)
 	 * Park and Miller, Communications of the ACM, vol. 31, no. 10,
 	 * October 1988, p. 1195.
 	 */
+	if (randseed == 0 || randseed >= 0x7fffffff)	/* defensive */
+		randseed = 16807;
 	x = randseed;
 	hi = x / 127773;
 	lo = x % 127773;