set FIPS allow before initialising ctx
authorDr. Stephen Henson <steve@openssl.org>
Tue, 14 Jun 2011 15:25:21 +0000 (15:25 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Tue, 14 Jun 2011 15:25:21 +0000 (15:25 +0000)
ssl/s3_srvr.c

index 8600d06..197a498 100644 (file)
@@ -1921,10 +1921,10 @@ int ssl3_send_server_key_exchange(SSL *s)
                                j=0;
                                for (num=2; num > 0; num--)
                                        {
-                                       EVP_DigestInit_ex(&md_ctx,(num == 2)
-                                               ?s->ctx->md5:s->ctx->sha1, NULL);
                                        EVP_MD_CTX_set_flags(&md_ctx,
                                                EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+                                       EVP_DigestInit_ex(&md_ctx,(num == 2)
+                                               ?s->ctx->md5:s->ctx->sha1, NULL);
                                        EVP_DigestUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
                                        EVP_DigestUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
                                        EVP_DigestUpdate(&md_ctx,&(d[4]),n);