Browse Source

crypto: drbg - fix drbg_generate return val check

The drbg_generate returns 0 in success case. That means that
drbg_generate_long will always only generate drbg_max_request_bytes at
most. Longer requests will be truncated to drbg_max_request_bytes.

Reported-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stephan Mueller 10 năm trước cách đây
mục cha
commit
082eb10ba9
1 tập tin đã thay đổi với 7 bổ sung7 xóa
  1. 7 7
      crypto/drbg.c

+ 7 - 7
crypto/drbg.c

@@ -1442,19 +1442,19 @@ static int drbg_generate_long(struct drbg_state *drbg,
 			      unsigned char *buf, unsigned int buflen,
 			      unsigned char *buf, unsigned int buflen,
 			      struct drbg_string *addtl)
 			      struct drbg_string *addtl)
 {
 {
-	int len = 0;
+	unsigned int len = 0;
 	unsigned int slice = 0;
 	unsigned int slice = 0;
 	do {
 	do {
-		int tmplen = 0;
+		int err = 0;
 		unsigned int chunk = 0;
 		unsigned int chunk = 0;
 		slice = ((buflen - len) / drbg_max_request_bytes(drbg));
 		slice = ((buflen - len) / drbg_max_request_bytes(drbg));
 		chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
 		chunk = slice ? drbg_max_request_bytes(drbg) : (buflen - len);
-		tmplen = drbg_generate(drbg, buf + len, chunk, addtl);
-		if (0 >= tmplen)
-			return tmplen;
-		len += tmplen;
+		err = drbg_generate(drbg, buf + len, chunk, addtl);
+		if (0 > err)
+			return err;
+		len += chunk;
 	} while (slice > 0 && (len < buflen));
 	} while (slice > 0 && (len < buflen));
-	return len;
+	return 0;
 }
 }
 
 
 /*
 /*