Fix security and robustness issues in HTTP parsing and I/O

2026-10-17 14:16:59 +03:00
parent 18ebe25d34
commit 19359f73b7
2 changed files with 31 additions and 11 deletions
@@ -3,6 +3,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <time.h>
 #include <errno.h>
 #include <stdint.h>

@@ -60,13 +61,17 @@ void generate_uuid(char out[37]) {
  unsigned char b[16];
  size_t i;
  FILE *f = fopen("/dev/urandom", "rb");
+  size_t got = 0;
  if (f) {
-    size_t got = fread(b, 1, 16, f);
-    fclose(f);
-    if (got != 16) {
-      for (i = 0; i < 16; i++) b[i] = (unsigned char)(rand() & 0xff);
+    while (got < 16) {
+      size_t r = fread(b + got, 1, 16 - got, f);
+      if (r == 0) break;
+      got += r;
    }
-  } else {
+    fclose(f);
+  }
+  if (got != 16) {
+    srand((unsigned int)(time(NULL) ^ (unsigned int)getpid()));
    for (i = 0; i < 16; i++) b[i] = (unsigned char)(rand() & 0xff);
  }
  b[6] = (unsigned char)((b[6] & 0x0f) | 0x40);