Check rng return value when generating SPIs in kernel-klips plugin

diff --git a/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c b/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c
index b8d44d686e39ecb6541c2040cde027e4623960fd..7e58cf30b78ae48fb2de73c2e8c37ec39395b979 100644 (file)
--- a/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c
+++ b/src/libhydra/plugins/kernel_klips/kernel_klips_ipsec.c
@@ -1520,12 +1520,12 @@ METHOD(kernel_ipsec_t, get_spi, status_t,
        u_int32_t spi_gen;
 
        rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
-       if (!rng)
+       if (!rng || !rng->get_bytes(rng, sizeof(spi_gen), (void*)&spi_gen))
        {
-               DBG1(DBG_KNL, "allocating SPI failed: no RNG");
+               DBG1(DBG_KNL, "allocating SPI failed");
+               DESTROY_IF(rng);
                return FAILED;
        }
-       rng->get_bytes(rng, sizeof(spi_gen), (void*)&spi_gen);
        rng->destroy(rng);
 
        /* allocated SPIs lie within the range from 0xc0000000 to 0xcFFFFFFF */