From b0e18aa736dce7175f40cd1c371e81ce1958e24f Mon Sep 17 00:00:00 2001 From: delphij Date: Thu, 17 Apr 2014 20:09:41 +0000 Subject: [PATCH] Cherry-pick OpenSSL changeset 5be1ae2: ==== Author: Dr. Stephen Henson Treat a zero length passed to ssleay_rand_add a no op: the existing logic zeroes the md value which is very bad. OpenSSL itself never does this internally and the actual call doesn't make sense as it would be passing zero bytes of entropy. Thanks to Marcus Meissner for reporting this bug. ==== This is a direct commit to stable/8 and stable/9. -HEAD and stable/10 already have this fix as part of OpenSSL 1.0.1g. Noticed by: koobs Reviewed by: benl (maintainer) git-svn-id: svn://svn.freebsd.org/base/stable/9@264624 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- crypto/openssl/crypto/rand/md_rand.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crypto/openssl/crypto/rand/md_rand.c b/crypto/openssl/crypto/rand/md_rand.c index 0f8dd3e00..4e723d500 100644 --- a/crypto/openssl/crypto/rand/md_rand.c +++ b/crypto/openssl/crypto/rand/md_rand.c @@ -199,6 +199,9 @@ static void ssleay_rand_add(const void *buf, int num, double add) EVP_MD_CTX m; int do_not_lock; + if (!num) + return; + /* * (Based on the rand(3) manpage) * -- 2.45.0