commit 266483d2f56b0764849797f31866bfd84f9c3aa8
author Matt Caswell <matt@openssl.org> Thu Feb 26 11:57:37 2015 +0000
committer Matt Caswell <matt@openssl.org> Wed Mar 25 12:38:07 2015 +0000
tree 42323d0c8b8cea8da4aff3dfdd4bc2251e34a0db
parent 8817e2e0c998757d3bd036d7f45fe8d0a49fbe2d

RAND_bytes updates

Ensure RAND_bytes return value is checked correctly, and that we no longer
use RAND_pseudo_bytes.

Reviewed-by: Richard Levitte <levitte@openssl.org>

ssl/s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 27f03d4..bab95f3 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2810,7 +2810,12 @@
 
             EVP_PKEY_encrypt_init(pkey_ctx);
             /* Generate session key */
-            RAND_bytes(pms, pmslen);
+            if (RAND_bytes(pms, pmslen) <= 0) {
+                EVP_PKEY_CTX_free(pkey_ctx);
+                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+                       ERR_R_INTERNAL_ERROR);
+                goto err;
+            };
             /*
              * If we have client certificate, use its secret as peer key
              */