From 4fd3160179620e26e90b38ec9b093aa893cd0911 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Tue, 6 Mar 2018 22:02:19 +0800 Subject: fix uninitialised memory in fuzzer codepath --- packet.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/packet.c b/packet.c index 90470ee..cacc06d 100644 --- a/packet.c +++ b/packet.c @@ -364,9 +364,11 @@ static int checkmac() { #if DROPBEAR_FUZZ if (fuzz.fuzzing) { - /* fail 1 in 2000 times to test error path. - note that mac_bytes is all zero prior to kex, so don't test ==0 ! */ - unsigned int value = *((unsigned int*)&mac_bytes); + /* fail 1 in 2000 times to test error path. */ + unsigned int value = 0; + if (mac_size > sizeof(value)) { + memcpy(&value, mac_bytes, sizeof(value)); + } if (value % 2000 == 99) { return DROPBEAR_FAILURE; } -- cgit v1.2.3