PR: 2522

Submitted by: Henrik Grindal Bakken <henribak@cisco.com>

Don't compare past end of buffer.

diff --git a/fips/rand/fips_drbg_lib.c b/fips/rand/fips_drbg_lib.c
index 7892a02b60227bc6390d78903232f62f63a4d19c..46f059d05806da31fbc69c2805ac14da100e00c8 100644 (file)
--- a/fips/rand/fips_drbg_lib.c
+++ b/fips/rand/fips_drbg_lib.c
@@ -145,7 +145,7 @@ static size_t fips_get_entropy(DRBG_CTX *dctx, unsigned char **pout,
        if (rv < (min_len + bl) || (rv % bl))
                return 0;
        /* Compare consecutive blocks for continuous PRNG test */
-       for (p = tout; p < tout + rv; p += bl)
+       for (p = tout; p < tout + rv - bl; p += bl)
                {
                if (!memcmp(p, p + bl, bl))
                        {