arc4random() returns an unsigned 32-bit int but sendmail expects the

RNG to return a signed (but positive) value.  This resulted in some
random numbers being interpreted as signed negative.  In one case
the result was being used to traverse an array so bad things (tm)
were happening.  The fix is to simply mask out the sign bit.

diff --git a/gnu/usr.sbin/sendmail/sendmail/conf.h b/gnu/usr.sbin/sendmail/sendmail/conf.h
index f2a83c3..9de4ecf 100644 (file)
--- a/gnu/usr.sbin/sendmail/sendmail/conf.h
+++ b/gnu/usr.sbin/sendmail/sendmail/conf.h
@@ -2678,7 +2678,7 @@ typedef void              (*sigfunc_t) __P((int));
 
 /* random routine -- set above using #ifdef _osname_ or in Makefile */
 #if HASARC4RANDOM
-# define get_random()  arc4random()
+# define get_random()  (arc4random() & 0x7fffffff)
 #else
 # if HASRANDOM
 #  define get_random() random()