Check RAND_bytes() return value or use RAND_pseudo_bytes().
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index c6cc4f7..fd20f80 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -816,7 +816,7 @@
p=s->s3->server_random;
Time=time(NULL); /* Time */
l2n(Time,p);
- RAND_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
+ RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
/* Do the message type and length last */
d=p= &(buf[4]);
@@ -1292,7 +1292,7 @@
{
p[0]=(s->version>>8);
p[1]=(s->version & 0xff);
- RAND_bytes(&(p[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
+ RAND_pseudo_bytes(&(p[2]),SSL_MAX_MASTER_KEY_LENGTH-2);
i=SSL_MAX_MASTER_KEY_LENGTH;
}
/* else, an SSLeay bug, ssl only server, tls client */
