ports/162526: Sigbus in minidlna port because read_random_bytes treats size_t as signed

[Wes Santee]

>Number:         162526
>Category:       ports
>Synopsis:       Sigbus in minidlna port because read_random_bytes treats size_t as signed
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Nov 13 18:50:10 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Wes Santee
>Release:        8.1-RELEASE
>Organization:
>Environment:
FreeBSD helena.bogon.lan 8.1-RELEASE FreeBSD 8.1-RELEASE #1: Sat Sep  4 05:28:16 EDT 2010     root at helena.private.bogon.net:/usr/obj/usr/src/sys/HELENA  amd64

>Description:
The patch for the net/minidlna port replaces read_random_bytes in uuid.c.  However, the while loop in the replaced function treats the size_t variable 'size' as signed, causing the while loop break condition to fail, which then causes a sigbus.
>How-To-Repeat:
Run minidlna port (possibly only happens on amd64 host).
>Fix:
In uuid.c, replace:


read_random_bytes(unsigned char *buf, size_t size)
{
        long r;
        srandomdev();

        while (size > 0) {
                r = random();
                memcpy(buf, &r,
                    size > sizeof(r) ? sizeof(r) : size);
                buf += sizeof(r);
                size -= sizeof(r);
        }
}

with (note cast in while loop):


read_random_bytes(unsigned char *buf, size_t size)
{
        long r;
        srandomdev();

        while ((ssize_t)size > 0) {
                r = random();
                memcpy(buf, &r,
                    size > sizeof(r) ? sizeof(r) : size);
                buf += sizeof(r);
                size -= sizeof(r);
        }
}

Or, fix the buf and size arithmetic within the while loop to prevent 'size' from going below zero.


>Release-Note:
>Audit-Trail:
>Unformatted: