tls1_process_heartbeat/dtls1_process_heartbeat don't check RAND_pseudo_bytes return value

[Kylo Ginsberg]

Looking at the heartbeat code, I notice that neither of the process
heartbeat functions check whether RAND_pseudo_bytes returned success when
it is generating the heartbeat padding.

I don't know if there are real-world scenarios where this could happen, but
if so, I believe this would "bleed" 16 bytes of heap memory in the
heartbeat response.

A patch might look like this:

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index d8bcd58..a607d8c 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -1367,8 +1367,13 @@ dtls1_process_heartbeat(SSL *s)
                s2n(payload, bp);
                memcpy(bp, pl, payload);
                bp += payload;
+
                /* Random padding */
-               RAND_pseudo_bytes(bp, padding);
+               if (RAND_pseudo_bytes(bp, padding) < 0)
+                       {
+                       OPENSSL_free(buffer);
+                       return 0;
+                       }

                r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer,
write_length);

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index bcb99b8..f1a53e6 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -4000,8 +4000,13 @@ tls1_process_heartbeat(SSL *s)
                s2n(payload, bp);
                memcpy(bp, pl, payload);
                bp += payload;
+
                /* Random padding */
-               RAND_pseudo_bytes(bp, padding);
+               if (RAND_pseudo_bytes(bp, padding) < 0)
+                       {
+                       OPENSSL_free(buffer);
+                       return 0;
+                       }

                r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 +
payload + padding);

Comments?

Thanks,
Kylo