Return if ssleay_rand_add called with zero num.

Treat a zero length passed to ssleay_rand_add a no op: the existing logic
zeroes the md value which is very bad. OpenSSL itself never does this
internally and the actual call doesn't make sense as it would be passing
zero bytes of entropy.

Thanks to Marcus Meissner <meissner@suse.de> for reporting this bug.

diff --git a/crypto/rand/md_rand.c b/crypto/rand/md_rand.c
index dd291637275d3aeae7ec2b1de81af268aeb0edf3..aee1c30b0a9bb4a24cc1dd90694f25a0ed852c5b 100644 (file)
--- a/crypto/rand/md_rand.c
+++ b/crypto/rand/md_rand.c
@@ -198,6 +198,9 @@ static void ssleay_rand_add(const void *buf, int num, double add)
        EVP_MD_CTX m;
        int do_not_lock;
 
+       if (!num)
+               return;
+
        /*
         * (Based on the rand(3) manpage)
         *