Blame 0001-CVE-2018-4700-Linux-session-cookies-used-a-predictab.patch
|
 |
13d9a7a |
diff --git a/cgi-bin/var.c b/cgi-bin/var.c
|
|
|
13d9a7a |
index 316b67f05..12f3c8344 100644
|
|
|
13d9a7a |
--- a/cgi-bin/var.c
|
|
|
13d9a7a |
+++ b/cgi-bin/var.c
|
|
|
13d9a7a |
@@ -1186,6 +1186,7 @@ cgi_set_sid(void)
|
|
|
13d9a7a |
const char *remote_addr, /* REMOTE_ADDR */
|
|
|
13d9a7a |
*server_name, /* SERVER_NAME */
|
|
|
13d9a7a |
*server_port; /* SERVER_PORT */
|
|
|
13d9a7a |
+ struct timeval curtime; /* Current time */
|
|
|
13d9a7a |
|
|
|
13d9a7a |
|
|
|
13d9a7a |
if ((remote_addr = getenv("REMOTE_ADDR")) == NULL)
|
|
|
13d9a7a |
@@ -1195,7 +1196,8 @@ cgi_set_sid(void)
|
|
|
13d9a7a |
if ((server_port = getenv("SERVER_PORT")) == NULL)
|
|
|
13d9a7a |
server_port = "SERVER_PORT";
|
|
|
13d9a7a |
|
|
|
13d9a7a |
- CUPS_SRAND(time(NULL));
|
|
|
13d9a7a |
+ gettimeofday(&curtime, NULL);
|
|
|
13d9a7a |
+ CUPS_SRAND(curtime.tv_sec + curtime.tv_usec);
|
|
|
13d9a7a |
snprintf(buffer, sizeof(buffer), "%s:%s:%s:%02X%02X%02X%02X%02X%02X%02X%02X",
|
|
|
13d9a7a |
remote_addr, server_name, server_port,
|
|
|
13d9a7a |
(unsigned)CUPS_RAND() & 255, (unsigned)CUPS_RAND() & 255,
|