From 4c67917f935d2b8b7c44eb696f5a0be793ff1332 Mon Sep 17 00:00:00 2001 From: Tedd Ho-Jeong An Date: Wed, 8 Dec 2021 14:39:20 -0800 Subject: [PATCH] peripheral: Replace random number generation function This patch replaces the rand() function to the getrandom() syscall. It was reported by the Coverity scan rand() should not be used for security-related applications, because linear congruential algorithms are too easy to break Signed-off-by: Anuj Jain Signed-off-by: Ayush Garg --- peripheral/main.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/peripheral/main.c b/peripheral/main.c index 45e103f..b20006e 100755 --- a/peripheral/main.c +++ b/peripheral/main.c @@ -24,6 +24,7 @@ #include #include #include +#include #ifndef WAIT_ANY #define WAIT_ANY (-1) @@ -190,11 +191,11 @@ int main(int argc, char *argv[]) addr, 6) < 0) { printf("Generating new persistent static address\n"); - addr[0] = rand(); - addr[1] = rand(); - addr[2] = rand(); - addr[3] = 0x34; - addr[4] = 0x12; + if (getrandom(addr, sizeof(addr), 0) < 0) { + perror("Failed to get random static address"); + return EXIT_FAILURE; + } + /* Overwrite the MSB to make it a static address */ addr[5] = 0xc0; efivars_write("BluetoothStaticAddress", -- 2.7.4