浏览代码

Use random number to generate websocket client mask

bel 9 年之前
父节点
当前提交
2e2cf78ab0
共有 1 个文件被更改,包括 14 次插入4 次删除
  1. 14 4
      src/civetweb.c

+ 14 - 4
src/civetweb.c

@@ -8153,14 +8153,24 @@ mg_websocket_client_write(struct mg_connection *conn,
 {
 	int retval = -1;
 	size_t i = 0;
-	uint32_t masking_key =
-	    0x1594DAC0; /* TODO (mid): replace by random generator */
+	static uint64_t lfsr = 0;
+	uint32_t masking_key;
 	char *masked_data = (char *)mg_malloc(((dataLen + 7) / 4) * 4);
 
+	if (lfsr == 0) {
+		lfsr = (uint64_t)time(NULL);
+	} else {
+		lfsr = (lfsr >> 1)
+		       | ((((lfsr >> 0) ^ (lfsr >> 1) ^ (lfsr >> 3) ^ (lfsr >> 4)) & 1)
+		          << 63);
+	}
+	masking_key = (uint32_t)lfsr;
+
 	if (masked_data == NULL) {
 		/* Return -1 in an error case */
-		mg_cry(conn, "Cannot allocate buffer for masked websocket response: "
-		             "Out of memory");
+		mg_cry(conn,
+		       "Cannot allocate buffer for masked websocket response: "
+		       "Out of memory");
 		return -1;
 	}
 	for (i = 0; i < dataLen; i += 4) {