Re: [PATCH] Make av_get_random_seed not block when waiting for more entropy
Michael Niedermayer <michaelni <at> gmx.at>
2010-06-30 23:12:37 GMT
On Wed, Jun 30, 2010 at 11:54:05PM +0100, Måns Rullgård wrote:
> Michael Niedermayer <michaelni <at> gmx.at> writes:
>
> > On Wed, Jun 30, 2010 at 10:20:29PM +0100, Måns Rullgård wrote:
> >> Michael Niedermayer <michaelni <at> gmx.at> writes:
> >>
> >> > On Wed, Jun 30, 2010 at 09:53:55PM +0100, Måns Rullgård wrote:
> >> >> Michael Niedermayer <michaelni <at> gmx.at> writes:
> >> >>
> >> >> > On Wed, Jun 30, 2010 at 09:07:40PM +0100, Måns Rullgård wrote:
> >> >> >> Michael Niedermayer <michaelni <at> gmx.at> writes:
> >> >> >>
> >> >> >> > On Wed, Jun 30, 2010 at 07:28:16PM +0300, Martin Storsjö wrote:
> >> >> >> >> On Wed, 30 Jun 2010, Måns Rullgård wrote:
> >> >> >> >>
> >> >> >> >> > Martin Storsjö <martin <at> martin.st> writes:
> >> >> >> >> >
> >> >> >> >> > > On Wed, 30 Jun 2010, Michael Niedermayer wrote:
> >> >> >> >> > >
> >> >> >> >> > >> before you spend more time on this.
> >> >> >> >> > >> There is a possible security issue with using non block mode
> >> >> >> >> > >> namely if we have /dev/*random and not use it we can end up
> >> >> >> >> > >> using a uninitialized variable. Thats an information leak
> >> >> >> >> > >> it could leak from pointers (kills ASLR) to OS/platform or
> >> >> >> >> > >> compiler version or or or ...
> >> >> >> >> > >> thats all usefull information for a attacker
> >> >> >> >> > >> he only has to saturate /dev/random so it would block
> >> >> >> >> > >
> >> >> >> >> > > Could you elaborate on your concern here? The fix he committed tries
> >> >> >> >> > > both /dev/random and /dev/urandom, and the latter should never block
(Continue reading)