MFC: Use arc4random_buf(3) if available to generate cookies.

Advisory X41-2017-001: Multiple Vulnerabilities in X.Org.

1 files changed, 7 insertions, 0 deletions

diff --git a/xserver/os/auth.c b/xserver/os/auth.c
index 7da6fc6ed..e0cd0186b 100644
--- a/xserver/os/auth.c
+++ b/xserver/os/auth.c
@@ -45,6 +45,9 @@ from The Open Group.
 #ifdef WIN32
 #include    <X11/Xw32defs.h>
 #endif
+#ifdef HAVE_LIBBSD
+#include   <bsd/stdlib.h>       /* for arc4random_buf() */
+#endif
 
 struct protocol {
     unsigned short name_length;
@@ -303,11 +306,15 @@ GenerateAuthorization(unsigned name_length,
 void
 GenerateRandomData(int len, char *buf)
 {
+#ifndef HAVE_ARC4RANDOMBUF
     int fd;
 
     fd = open("/dev/urandom", O_RDONLY);
     read(fd, buf, len);
     close(fd);
+#else
+    arc4random_buf(buf, len);
+#endif
 }
 
 #endif                          /* XCSECURITY */