diff options
| author | Rich Salz <rsalz@openssl.org> | 2017-07-19 17:41:26 -0400 |
|---|---|---|
| committer | Rich Salz <rsalz@openssl.org> | 2017-07-20 05:49:09 -0400 |
| commit | 4c75ee858893dee3c978ff2295fb5ef106797574 (patch) | |
| tree | da5c67d4896dc6ecd9b8cc481211f1419d8d0042 /crypto/rand | |
| parent | d76f646adeea13c14d15ee6c659b3a5785fdad33 (diff) | |
Add range-checking to RAND_DRBG_set_reseed_interval
As suggested by Kurt.
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/3970)
Diffstat (limited to 'crypto/rand')
| -rw-r--r-- | crypto/rand/drbg_lib.c | 7 | ||||
| -rw-r--r-- | crypto/rand/drbg_rand.c | 2 | ||||
| -rw-r--r-- | crypto/rand/rand_lcl.h | 3 |
3 files changed, 9 insertions, 3 deletions
diff --git a/crypto/rand/drbg_lib.c b/crypto/rand/drbg_lib.c index b9161ab23c..1588515441 100644 --- a/crypto/rand/drbg_lib.c +++ b/crypto/rand/drbg_lib.c @@ -328,11 +328,14 @@ int RAND_DRBG_set_callbacks(DRBG_CTX *dctx, } /* - * Set the reseed internal. Used mainly for the KATs. + * Set the reseed interval. Used mainly for the KATs. */ -void RAND_DRBG_set_reseed_interval(DRBG_CTX *dctx, int interval) +int RAND_DRBG_set_reseed_interval(DRBG_CTX *dctx, int interval) { + if (interval < 0 || interval > MAX_RESEED) + return 0; dctx->reseed_interval = interval; + return 1; } /* diff --git a/crypto/rand/drbg_rand.c b/crypto/rand/drbg_rand.c index 858f74a45e..4ff347c7ea 100644 --- a/crypto/rand/drbg_rand.c +++ b/crypto/rand/drbg_rand.c @@ -372,7 +372,7 @@ int ctr_init(DRBG_CTX *dctx) } dctx->max_request = 1 << 16; - dctx->reseed_interval = 1 << 24; + dctx->reseed_interval = MAX_RESEED; return 1; } diff --git a/crypto/rand/rand_lcl.h b/crypto/rand/rand_lcl.h index d65d49f3ac..689e3a34fd 100644 --- a/crypto/rand/rand_lcl.h +++ b/crypto/rand/rand_lcl.h @@ -20,6 +20,9 @@ /* we require 256 bits of randomness */ # define RANDOMNESS_NEEDED (256 / 8) +/* Maximum count allowed in reseeding */ +#define MAX_RESEED (1 << 24) + /* DRBG status values */ #define DRBG_STATUS_UNINITIALISED 0 #define DRBG_STATUS_READY 1 |