randomPassword() sometimes generates short passwords #114

Closed
opened 1 year ago by duke · 3 comments
duke commented 1 year ago
Owner

When SD generates a new config, it sometimes generates a short password instead of it being 10 chars:

# Autogenerated by Hush SilentDragonX 1.3.1 https://dragonx.is
server=1
rpcpassword=OU
rpcuser=dragonx
rpcport=21769
...

The bug seems to be in connection.cpp on the line :

s[i] = alphanum[randombytes_uniform(sizeof(alphanum))];

because s is a char * (8 bit) but randombytes_uniform returns a uint32_t value according to https://doc.libsodium.org/generating_random_data

This happens on OSX, it's not clear if it happens on other OS's as well.

When SD generates a new config, it sometimes generates a short password instead of it being 10 chars: ``` # Autogenerated by Hush SilentDragonX 1.3.1 https://dragonx.is server=1 rpcpassword=OU rpcuser=dragonx rpcport=21769 ... ``` The bug seems to be in connection.cpp on the line : ``` s[i] = alphanum[randombytes_uniform(sizeof(alphanum))]; ``` because `s` is a `char *` (8 bit) but `randombytes_uniform` returns a `uint32_t` value according to https://doc.libsodium.org/generating_random_data This happens on OSX, it's not clear if it happens on other OS's as well.
duke commented 1 year ago
Poster
Owner

Attempt at a fix on the dragonx branch : a557e25b61

needs testing

Attempt at a fix on the `dragonx` branch : https://git.hush.is/hush/SilentDragon/commit/a557e25b6136b3123543aa0a3c1ef94980400e14 needs testing
fekt commented 1 year ago
Collaborator

Seems to work as expected on OSX and Windows. Created 32 char password 10/10 times when deleting config and letting SD generate a new config.

Seems to work as expected on OSX and Windows. Created 32 char password 10/10 times when deleting config and letting SD generate a new config.
duke commented 1 year ago
Poster
Owner

This is fixed on the dev branch, closing

This is fixed on the `dev` branch, closing
duke closed this issue 1 year ago
Sign in to join this conversation.
No Milestone
No project
No Assignees
2 Participants
Notifications
Due Date

No due date set.

Dependencies

This issue currently doesn't have any dependencies.

Loading…
There is no content yet.