oss-security - expat hash collision fix too predictable?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120405093027.GB18070@suse.de>
Date: Thu, 5 Apr 2012 11:30:27 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: expat hash collision fix too predictable?

Hi,

while reviewing a expat regression (likely caused by the hash collision denial of service fix, but unclear)
i stumbled about the randomness it uses.

	static unsigned long
	generate_hash_secret_salt(void)
	{
	  unsigned int seed = time(NULL) % UINT_MAX;
	  srand(seed);
	  return rand();
	}

and it is seeded once at parser object creation.

This is better than not seeding, but I am not sure if it is sufficient.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.