- Tanguy Fautre pointed out that OpenSSL's function RAND_screen() (present

  only in some OpenSSL installs - like on Windows) isn't thread-safe and we
  agreed that moving it to the global_init() function is a decent way to deal
  with this situation.

diff --git a/CHANGES b/CHANGES
index 6d7b833e89cf8c3071ae460d89106027655821de..d2b194ffbe21dd8e341e6ef8a329b4254bb54731 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,11 @@
                                   Changelog
 
 Daniel Stenberg (1 Aug 2009)
+- Tanguy Fautre pointed out that OpenSSL's function RAND_screen() (present
+  only in some OpenSSL installs - like on Windows) isn't thread-safe and we
+  agreed that moving it to the global_init() function is a decent way to deal
+  with this situation.
+
 - Alexander Beedie provided the patch for a noproxy problem: If I have set
   CURLOPT_NOPROXY to "*", or to a host that should not use a proxy, I actually
   could still end up using a proxy if a proxy environment variable was set.

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index b715d5aef336afe3eb6286591bf502490b35eca6..bd5700f77a547002c773b3f14dd2e12c6871c0d8 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -39,6 +39,7 @@ This release includes the following bugfixes:
  o fix leak in gtls code
  o missing algorithms in libcurl+OpenSSL
  o with noproxy set you could still get a proxy if a proxy env was set
+ o rand seeding on libcurl on windows built with OpenSSL was not thread-safe
 
 This release includes the following known bugs:
 
@@ -51,6 +52,7 @@ advice from friends like these:
  Andre Guibert de Bruet, Mike Crowe, Claes Jakobsson, John E. Malmberg,
  Aaron Oneal, Igor Novoseltsev, Eric Wong, Bill Hoffman, Daniel Steinberg,
  Fabian Keil, Michal Marek, Reuven Wachtfogel, Markus Koetter,
- Constantine Sapuntzakis, David Binderman, Johan van Selst, Alexander Beedie
+ Constantine Sapuntzakis, David Binderman, Johan van Selst, Alexander Beedie,
+ Tanguy Fautre
 
         Thanks! (and sorry if I forgot to mention someone)

diff --git a/TODO-RELEASE b/TODO-RELEASE
index 513ad81cd1d083a27e53b306cb8323ba974a13ee..ad1e24f541cd5ac138730a70b6f526cb1187ed28 100644 (file)
--- a/TODO-RELEASE
+++ b/TODO-RELEASE
@@ -5,8 +5,6 @@ To be addressed in 7.19.6 (planned release: August 2009)
 
 249 - Wildcard cert name checking and null termination
 
-250 - RAND_screen() fix
-
 251 - TFTP block size
 
 252 - disable SNI for SSLv2 and SSLv3

diff --git a/lib/ssluse.c b/lib/ssluse.c
index 2365d52832cfc817f3cf361b24a7848d7d6ff6c3..ffc1fbd96e5952bcdb1d4d4685510668db7412d2 100644 (file)
--- a/lib/ssluse.c
+++ b/lib/ssluse.c
@@ -225,8 +225,7 @@ static int ossl_seed(struct SessionHandle *data)
   /* If we get here, it means we need to seed the PRNG using a "silly"
      approach! */
 #ifdef HAVE_RAND_SCREEN
-  /* This one gets a random value by reading the currently shown screen */
-  RAND_screen();
+  /* if RAND_screen() is present, it was called during global init */
   nread = 100; /* just a value */
 #else
   {
@@ -642,6 +641,13 @@ int Curl_ossl_init(void)
 
   OpenSSL_add_all_algorithms();
 
+#ifdef HAVE_RAND_SCREEN
+  /* This one gets a random value by reading the currently shown screen.
+     RAND_screen() is not thread-safe according to OpenSSL devs - although not
+     mentioned in documentation. */
+  RAND_screen();
+#endif
+
   return 1;
 }