Commit 3840bb5
src: fix CSPRNG when length exceeds INT_MAX
CSPRNG implicitly casts the size_t length argument to a signed int when
calling RAND_bytes(), which leaves it up to the caller to ensure that
the length argument actually fits into such a signed int. However, not
all call sites explicitly ensure that, which could lead to subtle bugs.
In OpenSSL 3, use RAND_bytes_ex() instead, which does not require
casting the length to a signed int.
In OpenSSL 1.1.1, RAND_bytes_ex() is not supported, thus we have to
process blocks of size INT_MAX one by one.
PR-URL: #47515
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 803ed41 commit 3840bb5
1 file changed
Lines changed: 12 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -61,10 +61,20 @@ int VerifyCallback(int preverify_ok, X509_STORE_CTX* ctx) { | |||
| 61 | 61 | } | |
| 62 | 62 | ||
| 63 | 63 | MUST_USE_RESULT CSPRNGResult CSPRNG(void* buffer, size_t length) { | |
| 64 | + unsigned char* buf = static_cast<unsigned char*>(buffer); | ||
| 64 | 65 | do { | |
| 65 | - if (1 == RAND_status()) | ||
| 66 | - if (1 == RAND_bytes(static_cast<unsigned char*>(buffer), length)) | ||
| 66 | + if (1 == RAND_status()) { | ||
| 67 | + #if OPENSSL_VERSION_MAJOR >= 3 | ||
| 68 | + if (1 == RAND_bytes_ex(nullptr, buf, length, 0)) return {true}; | ||
| 69 | + #else | ||
| 70 | + while (length > INT_MAX && 1 == RAND_bytes(buf, INT_MAX)) { | ||
| 71 | + buf += INT_MAX; | ||
| 72 | + length -= INT_MAX; | ||
| 73 | + } | ||
| 74 | + if (length <= INT_MAX && 1 == RAND_bytes(buf, static_cast<int>(length))) | ||
| 67 | 75 | return {true}; | |
| 76 | + #endif | ||
| 77 | + } | ||
| 68 | 78 | #if OPENSSL_VERSION_MAJOR >= 3 | |
| 69 | 79 | const auto code = ERR_peek_last_error(); | |
| 70 | 80 | // A misconfigured OpenSSL 3 installation may report 1 from RAND_poll() | |
0 commit comments