Fix BN_[pseudo_]rand: 'mask' must be used even if top=-1.

Mention BN_[pseudo_]rand with top=-1 in CHANGES.

diff --git a/CHANGES b/CHANGES
index 273e451cb17716d1aee7ab80f2e2b22ba00d2ffc..25987622a902934297a157182724796b19b524c4 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -39,6 +39,9 @@
 
   *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
      Bleichenbacher's DSA attack.
+     Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
+     to be set and top=0 forces the highest bit to be set; top=-1 is new
+     and leaves the highest bit random.
      [Ulf Moeller]
 
   *) In the NCONF_...-based implementations for CONF_... queries

diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c
index b6f546b88ea339019684b94ed4b87fee0a93f8d3..2e45770e8f1ae945bc4897fdd86b8dc3f85982da 100644 (file)
--- a/crypto/bn/bn_rand.c
+++ b/crypto/bn/bn_rand.c
@@ -76,7 +76,7 @@ static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
 
        bytes=(bits+7)/8;
        bit=(bits-1)%8;
-       mask=0xff<<bit;
+       mask=0xff<<(bit+1);
 
        buf=(unsigned char *)OPENSSL_malloc(bytes);
        if (buf == NULL)
@@ -104,7 +104,7 @@ static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
                {
                if (top)
                        {
-                       if (bit == 0)
+                       if (bit == 0)
                                {
                                buf[0]=1;
                                buf[1]|=0x80;
@@ -112,16 +112,15 @@ static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
                        else
                                {
                                buf[0]|=(3<<(bit-1));
-                               buf[0]&= ~(mask<<1);
                                }
                        }
                else
                        {
                        buf[0]|=(1<<bit);
-                       buf[0]&= ~(mask<<1);
                        }
                }
-       if (bottom) /* set bottom bits to whatever odd is */
+       buf[0] &= ~mask;
+       if (bottom) /* set bottom bit if requested */
                buf[bytes-1]|=1;
        if (!BN_bin2bn(buf,bytes,rnd)) goto err;
        ret=1;
@@ -156,7 +155,7 @@ int BN_rand_range(BIGNUM *r, BIGNUM *range)
                }
 
        n = BN_num_bits(range); /* n > 0 */
-       
+
        if (n == 1)
                {
                if (!BN_zero(r)) return 0;
@@ -194,4 +193,3 @@ int BN_rand_range(BIGNUM *r, BIGNUM *range)
 
        return 1;
        }
-