From: Dr. Stephen Henson <steve@openssl.org>
Date: Tue, 10 Dec 2013 12:52:27 +0000 (+0000)
Subject: Get FIPS checking logic right.
X-Git-Tag: OpenSSL_1_0_1f~12
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f1068a1ab726f477ad57783d0d488d4d55f87ded;p=thirdparty%2Fopenssl.git

Get FIPS checking logic right.

We need to lock when *not* in FIPS mode.
(cherry picked from commit 57c4e42d7545b51cbc00015defc81db7236dc15f)
---

diff --git a/crypto/rand/md_rand.c b/crypto/rand/md_rand.c
index 2dd22d2beba..dd291637275 100644
--- a/crypto/rand/md_rand.c
+++ b/crypto/rand/md_rand.c
@@ -382,7 +382,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
 	 */
 #ifdef OPENSSL_FIPS
 	/* NB: in FIPS mode we are already under a lock */
-	if (FIPS_mode())
+	if (!FIPS_mode())
 #endif
 		CRYPTO_w_lock(CRYPTO_LOCK_RAND);
 
@@ -464,7 +464,7 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
 	/* before unlocking, we must clear 'crypto_lock_rand' */
 	crypto_lock_rand = 0;
 #ifdef OPENSSL_FIPS
-	if (FIPS_mode())
+	if (!FIPS_mode())
 #endif
 		CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
 
@@ -519,13 +519,13 @@ static int ssleay_rand_bytes(unsigned char *buf, int num, int pseudo)
 	MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
 	MD_Update(&m,local_md,MD_DIGEST_LENGTH);
 #ifdef OPENSSL_FIPS
-	if (FIPS_mode())
+	if (!FIPS_mode())
 #endif
 		CRYPTO_w_lock(CRYPTO_LOCK_RAND);
 	MD_Update(&m,md,MD_DIGEST_LENGTH);
 	MD_Final(&m,md);
 #ifdef OPENSSL_FIPS
-	if (FIPS_mode())
+	if (!FIPS_mode())
 #endif
 		CRYPTO_w_unlock(CRYPTO_LOCK_RAND);