From 8db6703e5254ccd1e269ddd9c2aa38989efa0b6c Mon Sep 17 00:00:00 2001 From: Tedd Ho-Jeong An Date: Wed, 8 Dec 2021 14:39:23 -0800 Subject: [PATCH] profiles/health: Replace random number generation function This patch replaces the rand() function to the getrandom() syscall. It was reported by the Coverity scan rand() should not be used for security-related applications, because linear congruential algorithms are too easy to break Signed-off-by: Anuj Jain Signed-off-by: Ayush Garg --- profiles/health/hdp.c | 11 +++++++---- profiles/health/mcap.c | 17 +++++++++++++++-- 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/profiles/health/hdp.c b/profiles/health/hdp.c index 3dcdff8..52aecca 100755 --- a/profiles/health/hdp.c +++ b/profiles/health/hdp.c @@ -15,6 +15,7 @@ #include #include #include +#include #include @@ -1483,13 +1484,15 @@ static void destroy_create_dc_data(gpointer data) static void *generate_echo_packet(void) { uint8_t *buf; - int i; buf = g_malloc(HDP_ECHO_LEN); - srand(time(NULL)); + if (!buf) + return NULL; - for(i = 0; i < HDP_ECHO_LEN; i++) - buf[i] = rand() % UINT8_MAX; + if (getrandom(buf, HDP_ECHO_LEN, 0) < 0) { + g_free(buf); + return NULL; + } return buf; } diff --git a/profiles/health/mcap.c b/profiles/health/mcap.c index 439d19f..9055ead 100755 --- a/profiles/health/mcap.c +++ b/profiles/health/mcap.c @@ -17,6 +17,7 @@ #include #include #include +#include #include @@ -1886,6 +1887,7 @@ gboolean mcap_create_mcl(struct mcap_instance *mi, { struct mcap_mcl *mcl; struct connect_mcl *con; + uint16_t val; mcl = find_mcl(mi->mcls, addr); if (mcl) { @@ -1901,7 +1903,12 @@ gboolean mcap_create_mcl(struct mcap_instance *mi, mcl->state = MCL_IDLE; bacpy(&mcl->addr, addr); set_default_cb(mcl); - mcl->next_mdl = (rand() % MCAP_MDLID_FINAL) + 1; + if (getrandom(&val, sizeof(val), 0) < 0) { + mcap_instance_unref(mcl->mi); + g_free(mcl); + return FALSE; + } + mcl->next_mdl = (val % MCAP_MDLID_FINAL) + 1; } mcl->ctrl |= MCAP_CTRL_CONN; @@ -2011,6 +2018,7 @@ static void connect_mcl_event_cb(GIOChannel *chan, GError *gerr, bdaddr_t dst; char address[18], srcstr[18]; GError *err = NULL; + uint16_t val; if (gerr) return; @@ -2039,7 +2047,12 @@ static void connect_mcl_event_cb(GIOChannel *chan, GError *gerr, mcl->mi = mcap_instance_ref(mi); bacpy(&mcl->addr, &dst); set_default_cb(mcl); - mcl->next_mdl = (rand() % MCAP_MDLID_FINAL) + 1; + if (getrandom(&val, sizeof(val), 0) < 0) { + mcap_instance_unref(mcl->mi); + g_free(mcl); + goto drop; + } + mcl->next_mdl = (val % MCAP_MDLID_FINAL) + 1; } set_mcl_conf(chan, mcl); -- 2.7.4