check return value of RAND_pseudo_bytes; backport from the stable branch

[openssl.git] / ssl / s2_clnt.c

diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
index c6319bb63da68cb4fa282f93eca2c5db274508b6..415cdabb24df91a06b70c5af2c4b2ca9c62bac19 100644 (file)
--- a/ssl/s2_clnt.c
+++ b/ssl/s2_clnt.c
@@ -116,7 +116,6 @@
 #include <openssl/buffer.h>
 #include <openssl/objects.h>
 #include <openssl/evp.h>
-#include "cryptlib.h"
 
 static SSL_METHOD *ssl2_get_client_method(int ver);
 static int get_server_finished(SSL *s);
@@ -613,7 +612,8 @@ static int client_hello(SSL *s)
                s->s2->challenge_length=SSL2_CHALLENGE_LENGTH;
                s2n(SSL2_CHALLENGE_LENGTH,p);           /* challenge length */
                /*challenge id data*/
-               RAND_pseudo_bytes(s->s2->challenge,SSL2_CHALLENGE_LENGTH);
+               if (RAND_pseudo_bytes(s->s2->challenge,SSL2_CHALLENGE_LENGTH) <= 0)
+                       return -1;
                memcpy(d,s->s2->challenge,SSL2_CHALLENGE_LENGTH);
                d+=SSL2_CHALLENGE_LENGTH;
 
@@ -661,14 +661,16 @@ static int client_master_key(SSL *s)
                        SSLerr(SSL_F_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
                        return -1;
                        }
-               if (i > 0) RAND_pseudo_bytes(sess->key_arg,i);
+               if (i > 0)
+                       if (RAND_pseudo_bytes(sess->key_arg,i) <= 0)
+                               return -1;
 
                /* make a master key */
                i=EVP_CIPHER_key_length(c);
                sess->master_key_length=i;
                if (i > 0)
                        {
-                       if (i > sizeof sess->master_key)
+                       if (i > (int)sizeof(sess->master_key))
                                {
                                ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
                                SSLerr(SSL_F_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
@@ -688,7 +690,7 @@ static int client_master_key(SSL *s)
                else
                        enc=i;
 
-               if (i < enc)
+               if ((int)i < enc)
                        {
                        ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
                        SSLerr(SSL_F_CLIENT_MASTER_KEY,SSL_R_CIPHER_TABLE_SRC_ERROR);
@@ -717,7 +719,7 @@ static int client_master_key(SSL *s)
                d+=enc;
                karg=sess->key_arg_length;      
                s2n(karg,p); /* key arg size */
-               if (karg > sizeof sess->key_arg)
+               if (karg > (int)sizeof(sess->key_arg))
                        {
                        ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
                        SSLerr(SSL_F_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
@@ -1021,7 +1023,7 @@ static int get_server_finished(SSL *s)
                if (!(s->options & SSL_OP_MICROSOFT_SESS_ID_BUG))
                        {
                        if ((s->session->session_id_length > sizeof s->session->session_id)
-                           || (0 != memcmp(buf, s->session->session_id,
+                           || (0 != memcmp(buf + 1, s->session->session_id,
                                            (unsigned int)s->session->session_id_length)))
                                {
                                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
@@ -1035,7 +1037,7 @@ static int get_server_finished(SSL *s)
        }
 
 /* loads in the certificate from the server */
-int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
+int ssl2_set_certificate(SSL *s, int type, int len, const unsigned char *data)
        {
        STACK_OF(X509) *sk=NULL;
        EVP_PKEY *pkey=NULL;