public static byte[] checkTlsPreMasterSecretKey(int clientVersion,int serverVersion,SecureRandom random,byte[] encoded,boolean isFailOver){
  if (random == null) {
    random=JCAUtil.getSecureRandom();
  }
  byte[] replacer=new byte[48];
  random.nextBytes(replacer);
  if (!isFailOver && (encoded != null)) {
    if (encoded.length != 48) {
      return replacer;
    }
    int encodedVersion=((encoded[0] & 0xFF) << 8) | (encoded[1] & 0xFF);
    if (clientVersion != encodedVersion) {
      if (clientVersion > 0x0301 || serverVersion != encodedVersion) {
        encoded=replacer;
      }
    }
    return encoded;
  }
  return replacer;
}

public static byte [ ] checkTlsPreMasterSecretKey ( int clientVersion , int serverVersion , SecureRandom random , byte [ ] encoded , boolean isFailOver ) { if ( random == null ) { random = JCAUtil . getSecureRandom ( ) ; } byte [ ] replacer = new byte [ 48 ] ; random . nextBytes ( replacer ) ; if ( ! isFailOver && ( encoded != null ) ) { if ( encoded . length != 48 ) { return replacer ; } int encodedVersion = ( ( encoded [ 0 ] & 0xFF ) << 8 ) | ( encoded [ 1 ] & 0xFF ) ; if ( clientVersion != encodedVersion ) { if ( clientVersion > 0x0301 || serverVersion != encodedVersion ) { encoded = replacer ; } } return encoded ; } return replacer ; }
check the format of tls premastersecret . < p > to avoid vulnerabilities described by section 7 . 4 . 7 . 1 , rfc 5246 , treating incorrectly formatted message blocks and / or mismatched version numbers in a manner indistinguishable from correctly formatted rsa blocks . rfc 5246 describes the approach as : 1 . generate a string r of 48 random bytes 2 . decrypt the message to recover the plaintext m 3 . if the pkcs # 1 padding is not correct , or the length of message m is not exactly 48 bytes : pre_master_secret = r else if clienthello . client_version < = tls 1 . 0 , and version number check is explicitly disabled : premaster secret = m else if m [ 0 . . 1 ] ! = clienthello . client_version : premaster secret = r else : premaster secret = m note that # 2 should have completed before the call to this method .
