sid77 ([info]sid77) wrote,
@ 2008-05-13 23:53:00
Previous Entry  Add to memories!  Tell a Friend  Next Entry
Current mood: curious
Entry tags:chat madness, linux, wtf

Chat madness vol. 14 - Me & Gandalf reading the Debian patch of OpenSSL doom(tm) (italian only)
This should be the infamous diff:
--- openssl-0.9.8c.orig/crypto/rand/md_rand.c
+++ openssl-0.9.8c/crypto/rand/md_rand.c
@@ -271,7 +271,10 @@

...

+/*
+ * Don't add uninitialised data.
MD_Update(&m,buf,j);
+*/

...

+#if 0 /* Don't add uninitialised data. */
MD_Update(&m,buf,j); /* purify complains */
#endif
+#endif

And our comments:
(11:46:34 PM) bonzo: non so se mettermi a ridere o a piangere dai commenti
(11:47:01 PM) bonzo: perchè quel "Don't add uninitialised data." significa che:
(11:47:13 PM) bonzo: 1) il sec team non ha capito una mazza
(11:47:38 PM) bonzo: 2) i dati erano effettivamente randomizzati proprio bene da venir scambiati per roba non inizializzata :)
(11:47:49 PM) Gandalf: LOL


Create an Account
Forgot your login or password?
Login w/ OpenID
English • Español • Deutsch • Русский…