- (djm) [openbsd-compat/bsd-arc4random.c] Fix math bug that caused bias

   in arc4random_uniform with upper_bound in (2^30,2*31). Note that
   OpenSSH did not make requests with upper bounds in this range.

1 files changed, 1 insertions, 1 deletions

diff --git a/openbsd-compat/bsd-arc4random.c b/openbsd-compat/bsd-arc4random.c
index 92e7e7b58..9d4c8690e 100644
--- a/openbsd-compat/bsd-arc4random.c
+++ b/openbsd-compat/bsd-arc4random.c
@@ -129,7 +129,7 @@ arc4random_uniform(u_int32_t upper_bound)
                 min = 1 + ~upper_bound;         /* 2**32 - upper_bound */
         else {
                 /* (2**32 - (x * 2)) % x == 2**32 % x when x <= 2**31 */
-                min = ((0xffffffff - (upper_bound << 2)) + 1) % upper_bound;
+                min = ((0xffffffff - (upper_bound * 2)) + 1) % upper_bound;
         }
 #endif