From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from bus.compute.dc.uq.edu.au (bus.compute.dc.uq.edu.au [130.102.188.58]) by sourceware.org (Postfix) with ESMTPS id BFAD13858D1E for ; Sat, 31 Dec 2022 23:08:59 +0000 (GMT) Received: from smtp1.compute.dc.uq.edu.au (smtp1.compute.dc.uq.edu.au [10.208.11.2]) by bus.compute.dc.uq.edu.au (8.14.5/8.14.5) with ESMTP id 2BVN7w8i043503; Sun, 1 Jan 2023 09:07:58 +1000 Received: from mailhub.eait.uq.edu.au (holly.eait.uq.edu.au [130.102.79.58]) by smtp1.compute.dc.uq.edu.au (8.14.5/8.14.5) with ESMTP id 2BVN7wxC010916 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 1 Jan 2023 09:07:58 +1000 Received: from haru.mindrot.org (haru.mindrot.org [130.102.96.5]) by mailhub.eait.uq.edu.au (8.15.1/8.15.1) with ESMTPS id 2BVN7tXr009439 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 1 Jan 2023 09:07:55 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by haru.mindrot.org (OpenSMTPD) with ESMTP id fde45564; Sun, 1 Jan 2023 10:07:55 +1100 (AEDT) Date: Sun, 1 Jan 2023 10:07:55 +1100 (AEDT) From: Damien Miller To: Theo de Raadt cc: Alejandro Colomar , libc-alpha@sourceware.org, Alejandro Colomar , Theo de Raadt , "Todd C . Miller" , "Jason A. Donenfeld" , =?UTF-8?q?Cristian=20Rodr=C3=ADguez?= , Adhemerval Zanella , Yann Droneaud , Joseph Myers , otto@cvs.openbsd.org Subject: Re: [PATCH] Give a useful meaning to arc4random_uniform(0); In-Reply-To: <5084.1672476619@cvs.openbsd.org> Message-ID: References: <20221231023653.41877-1-alx@kernel.org> <5084.1672476619@cvs.openbsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Scanned-By: MIMEDefang 2.73 on UQ Mailhub on 130.102.188.58 X-Scanned-By: MIMEDefang 2.75 on 130.102.79.58 X-UQ-FilterTime: 1672528083 X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,KAM_DMARC_STATUS,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On Sat, 31 Dec 2022, Theo de Raadt wrote: > Also, right now an (incorrect?) call of arc4random_uniform(0) > will return 0, but with your proposal it will return a non-zero > number. Have you audited the entire universe of software to > ensure that your change doesn't introduce a bug in some other > piece of software? I doubt you did that. Very unprofessional > of you to not study the impact and just wave the issue away. > > I think Special-casing the value of 0 to mean something new > and undocumented behaviour makes no sense. It is even potentially > undocumentable. I agree - specifying a zero upper-bound is numerically nonsensical, and could often be the result of a bug in the caller. Changing it is likely to break code like this in a plausibly exploitable way: elem_t *random_elem(elem_t **elems, size_t nelems) { return elems[arc4random_uniform(nelems)]; } Therefore IMO the only safe return from arc4random_uniform(0) is 0. That changing make it fractionally simpler to implement one particular wrapper doesn't IMO justify it. -d