A bug exists which allows the sh variable to be used uninitialized when sscanf returns EOF.
Observe:
|
int main(int argc, char **argv) { |
|
unsigned char seed16[16] = {0}; |
|
unsigned char run32[32] = {0}; |
|
/* find iteration count */ |
|
if (argc > 1) { |
|
count = strtol(argv[1], NULL, 0); |
|
} |
|
|
|
/* find random seed */ |
|
if (argc > 2) { |
|
int pos = 0; |
|
const char* ch = argv[2]; |
|
while (pos < 16 && ch[0] != 0 && ch[1] != 0) { |
|
unsigned short sh; |
|
if (sscanf(ch, "%2hx", &sh)) { |
|
seed16[pos] = sh; |
|
} else { |
|
break; |
|
} |
|
ch += 2; |
|
pos++; |
|
} |
A simple fix would be to explicitly test if sscanf's return value is equal to 1.
A bug exists which allows the
shvariable to be used uninitialized when sscanf returns EOF.Observe:
bitcoin/src/secp256k1/src/tests.c
Lines 5019 to 5040 in 536590f
A simple fix would be to explicitly test if sscanf's return value is equal to 1.