diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2012-07-06 10:49:46 +0200 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2012-07-16 14:53:35 +0200 |
| commit | 392a9b110991f1246922b8689e94e3f9c2340ae0 (patch) | |
| tree | 3bf23899cfebea4b471ccb19b28205707780b0f6 /src/scepclient/scep.c | |
| parent | ae56e1eb97c4ae268b0ab40e8497c85d68b8175f (diff) | |
| download | strongswan-392a9b110991f1246922b8689e94e3f9c2340ae0.tar.bz2 strongswan-392a9b110991f1246922b8689e94e3f9c2340ae0.tar.xz | |
Check rng return value when generating SCEP sender nonce
Diffstat (limited to 'src/scepclient/scep.c')
| -rw-r--r-- | src/scepclient/scep.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/src/scepclient/scep.c b/src/scepclient/scep.c index 6b68a4742..d6cf5f2cc 100644 --- a/src/scepclient/scep.c +++ b/src/scepclient/scep.c @@ -183,7 +183,7 @@ void scep_generate_transaction_id(public_key_t *key, chunk_t *transID, /** * Adds a senderNonce attribute to the given pkcs9 attribute list */ -static void add_senderNonce_attribute(pkcs9_t *pkcs9) +static bool add_senderNonce_attribute(pkcs9_t *pkcs9) { const size_t nonce_len = 16; u_char nonce_buf[nonce_len]; @@ -191,10 +191,15 @@ static void add_senderNonce_attribute(pkcs9_t *pkcs9) rng_t *rng; rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK); - rng->get_bytes(rng, nonce_len, nonce_buf); + if (!rng || !rng->get_bytes(rng, nonce_len, nonce_buf)) + { + DESTROY_IF(rng); + return FALSE; + } rng->destroy(rng); pkcs9->set_attribute(pkcs9, OID_PKI_SENDER_NONCE, senderNonce); + return TRUE; } /** @@ -222,7 +227,12 @@ chunk_t scep_build_request(chunk_t data, chunk_t transID, scep_msg_t msg, pkcs9 = pkcs9_create(); pkcs9->set_attribute(pkcs9, OID_PKI_TRANS_ID, transID); pkcs9->set_attribute(pkcs9, OID_PKI_MESSAGE_TYPE, msgType); - add_senderNonce_attribute(pkcs9); + if (!add_senderNonce_attribute(pkcs9)) + { + pkcs9->destroy(pkcs9); + pkcs7->destroy(pkcs7); + return chunk_empty; + } pkcs7->set_attributes(pkcs7, pkcs9); pkcs7->set_certificate(pkcs7, signer_cert->get_ref(signer_cert)); |