# HG changeset patch # User Matt Johnston # Date 1520344939 -28800 # Node ID 8f7b6f75aa584d1e2c89017779c36ec52d108741 # Parent 60fceff958581d84453883057f74e1bfd23b28f4 fix uninitialised memory in fuzzer codepath diff -r 60fceff95858 -r 8f7b6f75aa58 packet.c --- a/packet.c Tue Mar 06 21:51:51 2018 +0800 +++ b/packet.c Tue Mar 06 22:02:19 2018 +0800 @@ -364,9 +364,11 @@ #if DROPBEAR_FUZZ if (fuzz.fuzzing) { - /* fail 1 in 2000 times to test error path. - note that mac_bytes is all zero prior to kex, so don't test ==0 ! */ - unsigned int value = *((unsigned int*)&mac_bytes); + /* fail 1 in 2000 times to test error path. */ + unsigned int value = 0; + if (mac_size > sizeof(value)) { + memcpy(&value, mac_bytes, sizeof(value)); + } if (value % 2000 == 99) { return DROPBEAR_FAILURE; }