4 files changed, 35 insertions, 55 deletions

diff --git a/util/libreboot-utils/include/common.h b/util/libreboot-utils/include/common.h
index 0c8fbd3d..7f063a8c 100644
--- a/util/libreboot-utils/include/common.h
+++ b/util/libreboot-utils/include/common.h
@@ -391,7 +391,7 @@ void *rmalloc(size_t *size); /* don't ever use this */
 void rset(void *buf, size_t n);
 void *mkrbuf(size_t n);
 char *mkrstr(size_t n);
-int win_lottery(char **buf);
+size_t rsize(size_t n);
 
 /* Helper functions for command: dump
  */
diff --git a/util/libreboot-utils/lib/rand.c b/util/libreboot-utils/lib/rand.c
index 3a0a94bf..3155eec3 100644
--- a/util/libreboot-utils/lib/rand.c
+++ b/util/libreboot-utils/lib/rand.c
@@ -72,37 +72,20 @@
  * or your program dies.
  */
 
-int
-win_lottery(char **buf) /* are u lucky? */
+void *
+rmalloc(size_t *rval)
 {
-	size_t size = 0;
-	int rval;
-
-	char *s1 = rmalloc(&size);
-	char *s2 = rmalloc(&size);
-
-	if (scmp(s1, s2, BUFSIZ + 2, &rval) >= 0 &&
-	    rval == 0)
-		rval = 1; /* winner! */
-	else
-		rval = 0;
-
-	(void) scat(s1, s2, BUFSIZ << 1, buf);
-
-	free_if_null(&s1);
-	free_if_null(&s2);
-
-	return rval;
+	return if_err(rval == NULL, EFAULT) ?
+	    NULL : mkrstr(*rval = rsize(BUFSIZ));
 }
 
-void *
-rmalloc(size_t *rval)
+size_t
+rsize(size_t n)
 {
-	if (if_err(rval == NULL, EFAULT))
-		return NULL;
+	size_t rval = SIZE_MAX;
+	for (; rval >= SIZE_MAX - (SIZE_MAX % n); rset(&rval, sizeof(rval)));
 
-	rset(rval, sizeof(*rval));
-	return mkrstr(*rval %= BUFSIZ);
+	return rval % n;
 }
 
 char *
@@ -114,7 +97,7 @@ mkrstr(size_t n) /* emulates spkmodem-decode */
 	if (n == 0)
 		err_no_cleanup(0, EPERM, "mkrbuf: zero-byte request");
 
-	if (n == SIZE_MAX)
+	if (n >= SIZE_MAX - 1)
 		err_no_cleanup(0, EOVERFLOW, "mkrbuf: overflow");
 
 	if (if_err((s = mkrbuf(n + 1)) == NULL, EFAULT))
@@ -132,11 +115,14 @@ mkrstr(size_t n) /* emulates spkmodem-decode */
 void *
 mkrbuf(size_t n)
 {
-	void *buf;
+	void *buf = "";
 
 	if (n == 0)
 		err_no_cleanup(0, EPERM, "mkrbuf: zero-byte request");
 
+	if (n >= SIZE_MAX - 1)
+		err_no_cleanup(0, EOVERFLOW, "integer overflow in mkrbuf");
+
 	if ((buf = malloc(n)) == NULL)
 		err_no_cleanup(0, ENOMEM, "mkrbuf: malloc");
 
diff --git a/util/libreboot-utils/lottery.c b/util/libreboot-utils/lottery.c
index 8157d7a9..dcede791 100644
--- a/util/libreboot-utils/lottery.c
+++ b/util/libreboot-utils/lottery.c
@@ -2,40 +2,38 @@
  * Copyright (c) 2026 Leah Rowe <leah@libreboot.org>
  */
 
-#ifdef __OpenBSD__
-#include <sys/param.h> /* pledge(2) */
-#endif
-
 #include <stdio.h>
-#include <stdlib.h>
+#include <string.h>
+
 #include "include/common.h"
+#define MAX_ALLOC (1 << 17)
+
+static int rigged(char **s);
 
 int
 main(int argc, char *argv[])
 {
-	char *s1 = NULL;
-	int rval = 0;
+	char *s = "You lose!";
+	int lucky = rigged(&s);
 
-#if defined(__OpenBSD__) && defined(OpenBSD)
-#if (OpenBSD) >= 509
+#ifdef __OpenBSD__
 	if (pledge("stdio", NULL) == -1)
-		err_no_cleanup(0, errno, "openbsd won it");
-#endif
+		err_no_cleanup(0, errno, "openbsd wins");
 #endif
-	setvbuf(stdout, NULL, _IONBF, 0);
+	printf("%s\n", s);
+	return lucky;
+}
 
-	if (win_lottery(&s1))
-		rval = 1;
-
-	if (s1 != NULL) {
-		printf("%s\n\n", s1);
-		free(s1);
-	}
+static int
+rigged(char **s) /* are u lucky? */
+{
+	size_t size[2] = { rsize(MAX_ALLOC), rsize(MAX_ALLOC) };
 
-	printf("%s\n", rval ? "You won!" : "You lose! Sorry!");
-	return rval? EXIT_SUCCESS : EXIT_FAILURE;
+	return !(size[0] && size[0] == size[1] && size[0] <= MAX_ALLOC << 1 &&
+	    s != NULL) || memcmp(*s = mkrbuf(size[0] << 1), *s + size[0],
+	    size[0]);
 }/*
 
   ( >:3 )    
-   /| |\
+   /| |\      it could be you!
     / \                                                                      */
diff --git a/util/spkmodem_decode/spkmodem-decode.c b/util/spkmodem_decode/spkmodem-decode.c
index 4af92b95..3b3b33f8 100644
--- a/util/spkmodem_decode/spkmodem-decode.c
+++ b/util/spkmodem_decode/spkmodem-decode.c
@@ -144,11 +144,7 @@
  * Convert tone frequency ranges into pulse counts within the
  * sliding analysis window.
  *
-<<<<<<< HEAD
- * pulse_count is: tone_frequency / FRAME_RATE
-=======
  * pulse_count = tone_frequency / FRAME_RATE
->>>>>>> a010665c1d (fix typo in comment)
  * where FRAME_RATE = SAMPLE_RATE / SAMPLES_PER_FRAME.
  */
 #define FREQ_SEP_MIN ((SEP_TONE_MIN_HZ) / (FRAME_RATE))