Fix CPRNG test for Hash DRBG.

[openssl.git] / fips / rand / fips_drbg_hash.c

diff --git a/fips/rand/fips_drbg_hash.c b/fips/rand/fips_drbg_hash.c
index 544cda1fff726a7d1729c3661d20a0f0a2166e91..2fdf0e8f3820d64adc99b5a534f78900eaa90450 100644 (file)
--- a/fips/rand/fips_drbg_hash.c
+++ b/fips/rand/fips_drbg_hash.c
@@ -199,9 +199,8 @@ static int hash_gen(DRBG_CTX *dctx, unsigned char *out, size_t outlen)
                        {
                        FIPS_digestfinal(&hctx->mctx, dctx->lb, NULL);
                        dctx->lb_valid = 1;
-                       continue;
                        }
-               if (outlen < dctx->blocklength)
+               else if (outlen < dctx->blocklength)
                        {
                        FIPS_digestfinal(&hctx->mctx, hctx->vtmp, NULL);
                        if (!fips_drbg_cprng_test(dctx, hctx->vtmp))
@@ -209,13 +208,16 @@ static int hash_gen(DRBG_CTX *dctx, unsigned char *out, size_t outlen)
                        memcpy(out, hctx->vtmp, outlen);
                        return 1;
                        }
-               FIPS_digestfinal(&hctx->mctx, out, NULL);
-               if (!fips_drbg_cprng_test(dctx, out))
-                       return 0;
-               outlen -= dctx->blocklength;
-               if (outlen == 0)
-                       return 1;
-               out += dctx->blocklength;
+               else
+                       {
+                       FIPS_digestfinal(&hctx->mctx, out, NULL);
+                       if (!fips_drbg_cprng_test(dctx, out))
+                               return 0;
+                       outlen -= dctx->blocklength;
+                       if (outlen == 0)
+                               return 1;
+                       out += dctx->blocklength;
+                       }
                ctx_add_buf(dctx, hctx->vtmp, NULL, 0);
                }
        }