Fix size limitation of RAND_DRBG_bytes()
authorDr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Sat, 3 Feb 2018 21:32:47 +0000 (22:32 +0100)
committerDr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Mon, 5 Feb 2018 19:05:14 +0000 (20:05 +0100)
When comparing the implementations of drbg_bytes() and RAND_DRBG_bytes(),
it was noticed that the former split the buffer into chunks when calling
RAND_DRBG_generate() to circumvent the size limitation of the buffer
to outlen <= drb->max_request. This loop was missing in RAND_DRBG_bytes(),
so it was adopted from drbg_bytes().

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
(Merged from https://github.com/openssl/openssl/pull/5251)

crypto/rand/drbg_lib.c

index 974e3bbd11f6108f21cc53970bef00d850de5ea7..c0c0b91cfd72a25b4b6c2259c1bdbe2bc53c08c8 100644 (file)
@@ -546,10 +546,22 @@ int RAND_DRBG_bytes(RAND_DRBG *drbg, unsigned char *out, size_t outlen)
 {
     unsigned char *additional = NULL;
     size_t additional_len;
+    size_t chunk;
     size_t ret;
 
     additional_len = rand_drbg_get_additional_data(&additional, drbg->max_adinlen);
-    ret = RAND_DRBG_generate(drbg, out, outlen, 0, additional, additional_len);
+
+    for ( ; outlen > 0; outlen -= chunk, out += chunk) {
+        chunk = outlen;
+        if (chunk > drbg->max_request)
+            chunk = drbg->max_request;
+        ret = RAND_DRBG_generate(drbg, out, chunk, 0, additional, additional_len);
+        if (!ret)
+            goto err;
+    }
+    ret = 1;
+
+err:
     if (additional_len != 0)
         OPENSSL_secure_clear_free(additional, additional_len);