From 3feff37ba51fa0a6a0a06f59682a0918aa5b04de Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Mon, 7 Apr 2025 12:52:16 +0200
Subject: [PATCH] plugins: use byte addressing of rand_pool_info data buffer

Fix out-of-bounds write in urandom plugin.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 plugins/urandom.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/plugins/urandom.c b/plugins/urandom.c
index d2a54983..e28bed88 100644
--- a/plugins/urandom.c
+++ b/plugins/urandom.c
@@ -78,6 +78,7 @@ static void setup(void *arg)
 {
 #ifdef RANDOMSEED
 	struct rand_pool_info *rpi;
+	unsigned char *rpi_buf;
 	ssize_t len = 0;
 	struct stat st;
 	int rc = -1;
@@ -137,10 +138,11 @@ static void setup(void *arg)
 		goto fallback;
 	}
 
+	rpi_buf = (unsigned char *)rpi->buf;
 	do {
 		ssize_t num;
 
-		num = read(fd, &rpi->buf[len], RANDOM_BYTES - len);
+		num = read(fd, &rpi_buf[len], RANDOM_BYTES - len);
 		if (num <= 0) {
 			if (num == -1 && errno == EINTR)
 				continue;