Buffer overflow fix.

[silc.git] / lib / silccrypt / silcrng.c

diff --git a/lib/silccrypt/silcrng.c b/lib/silccrypt/silcrng.c
index 5638181cc860e4f04e04c331ec2b943837d4499b..620ebecfba182d14445520bf738bb76f820afdda 100644 (file)
--- a/lib/silccrypt/silcrng.c
+++ b/lib/silccrypt/silcrng.c
@@ -44,7 +44,7 @@ extern pid_t getpgid (pid_t __pid);
 #define SILC_RNG_STATE_NUM 4
 
 /* Byte size of the random data pool. */
-#define SILC_RNG_POOLSIZE 1024
+#define SILC_RNG_POOLSIZE 1024 + 1
 
 static SilcUInt32 silc_rng_get_position(SilcRng rng);
 static void silc_rng_stir_pool(SilcRng rng);
@@ -158,6 +158,8 @@ SilcRng silc_rng_alloc(void)
 void silc_rng_free(SilcRng rng)
 {
   if (rng) {
+    SilcRngState t, n;
+
     memset(rng->pool, 0, sizeof(rng->pool));
     memset(rng->key, 0, sizeof(rng->key));
     silc_hash_free(rng->sha1);
@@ -166,6 +168,13 @@ void silc_rng_free(SilcRng rng)
     if (rng->fd_devurandom != -1)
       close(rng->fd_devurandom);
 
+    for (t = rng->state->next; t != rng->state; ) {
+      n = t->next;
+      silc_free(t);
+      t = n;
+    }
+    silc_free(rng->state);
+
     silc_free(rng);
   }
 }
@@ -399,7 +408,7 @@ static void silc_rng_stir_pool(SilcRng rng)
 
   /* First CFB pass */
   for (i = 0; i < SILC_RNG_POOLSIZE; i += 5) {
-    rng->sha1->hash->transform(iv, rng->key);
+    silc_hash_transform(rng->sha1, iv, rng->key);
     iv[0] = rng->pool[i] ^= iv[0];
     iv[1] = rng->pool[i + 1] ^= iv[1];
     iv[2] = rng->pool[i + 2] ^= iv[2];
@@ -412,7 +421,7 @@ static void silc_rng_stir_pool(SilcRng rng)
 
   /* Second CFB pass */
   for (i = 0; i < SILC_RNG_POOLSIZE; i += 5) {
-    rng->sha1->hash->transform(iv, rng->key);
+    silc_hash_transform(rng->sha1, iv, rng->key);
     iv[0] = rng->pool[i] ^= iv[0];
     iv[1] = rng->pool[i + 1] ^= iv[1];
     iv[2] = rng->pool[i + 2] ^= iv[2];
@@ -482,7 +491,7 @@ SilcUInt8 silc_rng_get_byte_fast(SilcRng rng)
   }
 
   if (read(rng->fd_devurandom, buf, sizeof(buf)) < 0)
-    return silc_rng_get_byte(rnf);
+    return silc_rng_get_byte(rng);
 
   return buf[0];
 #else