ssl/statem/statem_srvr.c:2074: error: UNINITIALIZED_VALUE
  The value read from nr[_] was never initialized.
Showing all 1 steps of the trace


ssl/statem/statem_srvr.c:2074:13: 
2072.           } else
2073.   #endif
2074. >             s2n(nr[i], p);
2075.           BN_bn2bin(r[i], p);
2076.           p += nr[i];

int tls_construct_server_key_exchange(SSL *s)
{
#ifndef OPENSSL_NO_RSA
    unsigned char *q;
    int j, num;
    RSA *rsa;
    unsigned char md_buf[MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH];
    unsigned int u;
#endif
#ifndef OPENSSL_NO_DH
    DH *dh = NULL, *dhp;
#endif
#ifndef OPENSSL_NO_EC
    EC_KEY *ecdh = NULL, *ecdhp;
    unsigned char *encodedPoint = NULL;
    int encodedlen = 0;
    int curve_id = 0;
    BN_CTX *bn_ctx = NULL;
#endif
    EVP_PKEY *pkey;
    const EVP_MD *md = NULL;
    unsigned char *p, *d;
    int al, i;
    unsigned long type;
    int n;
    CERT *cert;
    BIGNUM *r[4];
    int nr[4], kn;
    BUF_MEM *buf;
    EVP_MD_CTX md_ctx;
    EVP_MD_CTX_init(&md_ctx);
    type = s->s3->tmp.new_cipher->algorithm_mkey;
    cert = s->cert;
    buf = s->init_buf;
    r[0] = r[1] = r[2] = r[3] = NULL;
    n = 0;
#ifndef OPENSSL_NO_PSK
    if (type & SSL_PSK) {
        n += 2;
        if (s->cert->psk_identity_hint)
            n += strlen(s->cert->psk_identity_hint);
    }
    if (type & (SSL_kPSK | SSL_kRSAPSK)) {
    } else
#endif
#ifndef OPENSSL_NO_RSA
    if (type & SSL_kRSA) {
        rsa = cert->rsa_tmp;
        if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) {
            rsa = s->cert->rsa_tmp_cb(s,
                                      SSL_C_IS_EXPORT(s->s3->
                                                      tmp.new_cipher),
                                      SSL_C_EXPORT_PKEYLENGTH(s->s3->
                                                              tmp.new_cipher));
            if (rsa == NULL) {
                al = SSL_AD_HANDSHAKE_FAILURE;
                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                       SSL_R_ERROR_GENERATING_TMP_RSA_KEY);
                goto f_err;
            }
            RSA_up_ref(rsa);
            cert->rsa_tmp = rsa;
        }
        if (rsa == NULL) {
            al = SSL_AD_HANDSHAKE_FAILURE;
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   SSL_R_MISSING_TMP_RSA_KEY);
            goto f_err;
        }
        r[0] = rsa->n;
        r[1] = rsa->e;
        s->s3->tmp.use_rsa_tmp = 1;
    } else
#endif
#ifndef OPENSSL_NO_DH
    if (type & (SSL_kDHE | SSL_kDHEPSK)) {
        if (s->cert->dh_tmp_auto) {
            dhp = ssl_get_auto_dh(s);
            if (dhp == NULL) {
                al = SSL_AD_INTERNAL_ERROR;
                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                       ERR_R_INTERNAL_ERROR);
                goto f_err;
            }
        } else
            dhp = cert->dh_tmp;
        if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))
            dhp = s->cert->dh_tmp_cb(s,
                                     SSL_C_IS_EXPORT(s->s3->
                                                     tmp.new_cipher),
                                     SSL_C_EXPORT_PKEYLENGTH(s->s3->
                                                             tmp.new_cipher));
        if (dhp == NULL) {
            al = SSL_AD_HANDSHAKE_FAILURE;
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   SSL_R_MISSING_TMP_DH_KEY);
            goto f_err;
        }
        if (!ssl_security(s, SSL_SECOP_TMP_DH,
                          DH_security_bits(dhp), 0, dhp)) {
            al = SSL_AD_HANDSHAKE_FAILURE;
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   SSL_R_DH_KEY_TOO_SMALL);
            goto f_err;
        }
        if (s->s3->tmp.dh != NULL) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   ERR_R_INTERNAL_ERROR);
            goto err;
        }
        if (s->cert->dh_tmp_auto)
            dh = dhp;
        else if ((dh = DHparams_dup(dhp)) == NULL) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);
            goto err;
        }
        s->s3->tmp.dh = dh;
        if ((dhp->pub_key == NULL ||
             dhp->priv_key == NULL ||
             (s->options & SSL_OP_SINGLE_DH_USE))) {
            if (!DH_generate_key(dh)) {
                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);
                goto err;
            }
        } else {
            dh->pub_key = BN_dup(dhp->pub_key);
            dh->priv_key = BN_dup(dhp->priv_key);
            if ((dh->pub_key == NULL) || (dh->priv_key == NULL)) {
                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);
                goto err;
            }
        }
        r[0] = dh->p;
        r[1] = dh->g;
        r[2] = dh->pub_key;
    } else
#endif
#ifndef OPENSSL_NO_EC
    if (type & (SSL_kECDHE | SSL_kECDHEPSK)) {
        const EC_GROUP *group;
        ecdhp = cert->ecdh_tmp;
        if (s->cert->ecdh_tmp_auto) {
            int nid = tls1_shared_curve(s, -2);
            if (nid != NID_undef)
                ecdhp = EC_KEY_new_by_curve_name(nid);
        } else if ((ecdhp == NULL) && s->cert->ecdh_tmp_cb) {
            ecdhp = s->cert->ecdh_tmp_cb(s,
                                         SSL_C_IS_EXPORT(s->s3->
                                                         tmp.new_cipher),
                                         SSL_C_EXPORT_PKEYLENGTH(s->
                                                                 s3->tmp.new_cipher));
        }
        if (ecdhp == NULL) {
            al = SSL_AD_HANDSHAKE_FAILURE;
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   SSL_R_MISSING_TMP_ECDH_KEY);
            goto f_err;
        }
        if (s->s3->tmp.ecdh != NULL) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   ERR_R_INTERNAL_ERROR);
            goto err;
        }
        if (ecdhp == NULL) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);
            goto err;
        }
        if (s->cert->ecdh_tmp_auto)
            ecdh = ecdhp;
        else if ((ecdh = EC_KEY_dup(ecdhp)) == NULL) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);
            goto err;
        }
        s->s3->tmp.ecdh = ecdh;
        if ((EC_KEY_get0_public_key(ecdh) == NULL) ||
            (EC_KEY_get0_private_key(ecdh) == NULL) ||
            (s->options & SSL_OP_SINGLE_ECDH_USE)) {
            if (!EC_KEY_generate_key(ecdh)) {
                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                       ERR_R_ECDH_LIB);
                goto err;
            }
        }
        if (((group = EC_KEY_get0_group(ecdh)) == NULL) ||
            (EC_KEY_get0_public_key(ecdh) == NULL) ||
            (EC_KEY_get0_private_key(ecdh) == NULL)) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);
            goto err;
        }
        if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&
            (EC_GROUP_get_degree(group) > 163)) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);
            goto err;
        }
        if ((curve_id =
             tls1_ec_nid2curve_id(EC_GROUP_get_curve_name(group)))
            == 0) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);
            goto err;
        }
        encodedlen = EC_POINT_point2oct(group,
                                        EC_KEY_get0_public_key(ecdh),
                                        POINT_CONVERSION_UNCOMPRESSED,
                                        NULL, 0, NULL);
        encodedPoint = (unsigned char *)
            OPENSSL_malloc(encodedlen * sizeof(unsigned char));
        bn_ctx = BN_CTX_new();
        if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   ERR_R_MALLOC_FAILURE);
            goto err;
        }
        encodedlen = EC_POINT_point2oct(group,
                                        EC_KEY_get0_public_key(ecdh),
                                        POINT_CONVERSION_UNCOMPRESSED,
                                        encodedPoint, encodedlen, bn_ctx);
        if (encodedlen == 0) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);
            goto err;
        }
        BN_CTX_free(bn_ctx);
        bn_ctx = NULL;
        n += 4 + encodedlen;
        r[0] = NULL;
        r[1] = NULL;
        r[2] = NULL;
        r[3] = NULL;
    } else
#endif
#ifndef OPENSSL_NO_SRP
    if (type & SSL_kSRP) {
        if ((s->srp_ctx.N == NULL) ||
            (s->srp_ctx.g == NULL) ||
            (s->srp_ctx.s == NULL) || (s->srp_ctx.B == NULL)) {
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   SSL_R_MISSING_SRP_PARAM);
            goto err;
        }
        r[0] = s->srp_ctx.N;
        r[1] = s->srp_ctx.g;
        r[2] = s->srp_ctx.s;
        r[3] = s->srp_ctx.B;
    } else
#endif
    {
        al = SSL_AD_HANDSHAKE_FAILURE;
        SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
               SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
        goto f_err;
    }
    for (i = 0; i < 4 && r[i] != NULL; i++) {
        nr[i] = BN_num_bytes(r[i]);
#ifndef OPENSSL_NO_SRP
        if ((i == 2) && (type & SSL_kSRP))
            n += 1 + nr[i];
        else
#endif
            n += 2 + nr[i];
    }
    if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP))
        && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)) {
        if ((pkey = ssl_get_sign_pkey(s, s->s3->tmp.new_cipher, &md))
            == NULL) {
            al = SSL_AD_DECODE_ERROR;
            goto f_err;
        }
        kn = EVP_PKEY_size(pkey);
    } else {
        pkey = NULL;
        kn = 0;
    }
    if (!BUF_MEM_grow_clean(buf, n + SSL_HM_HEADER_LENGTH(s) + kn)) {
        SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_BUF);
        goto err;
    }
    d = p = ssl_handshake_start(s);
#ifndef OPENSSL_NO_PSK
    if (type & SSL_PSK) {
        if (s->cert->psk_identity_hint) {
            s2n(strlen(s->cert->psk_identity_hint), p);
            strncpy((char *)p, s->cert->psk_identity_hint,
                    strlen(s->cert->psk_identity_hint));
            p += strlen(s->cert->psk_identity_hint);
        } else {
            s2n(0, p);
        }
    }
#endif
    for (i = 0; i < 4 && r[i] != NULL; i++) {
#ifndef OPENSSL_NO_SRP
        if ((i == 2) && (type & SSL_kSRP)) {
            *p = nr[i];
            p++;
        } else
#endif
            s2n(nr[i], p);
        BN_bn2bin(r[i], p);
        p += nr[i];
    }
#ifndef OPENSSL_NO_EC
    if (type & (SSL_kECDHE | SSL_kECDHEPSK)) {
        *p = NAMED_CURVE_TYPE;
        p += 1;
        *p = 0;
        p += 1;
        *p = curve_id;
        p += 1;
        *p = encodedlen;
        p += 1;
        memcpy(p, encodedPoint, encodedlen);
        OPENSSL_free(encodedPoint);
        encodedPoint = NULL;
        p += encodedlen;
    }
#endif
    if (pkey != NULL) {
#ifndef OPENSSL_NO_RSA
        if (pkey->type == EVP_PKEY_RSA && !SSL_USE_SIGALGS(s)) {
            q = md_buf;
            j = 0;
            for (num = 2; num > 0; num--) {
                EVP_MD_CTX_set_flags(&md_ctx,
                                     EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
                EVP_DigestInit_ex(&md_ctx, (num == 2)
                                  ? s->ctx->md5 : s->ctx->sha1, NULL);
                EVP_DigestUpdate(&md_ctx, &(s->s3->client_random[0]),
                                 SSL3_RANDOM_SIZE);
                EVP_DigestUpdate(&md_ctx, &(s->s3->server_random[0]),
                                 SSL3_RANDOM_SIZE);
                EVP_DigestUpdate(&md_ctx, d, n);
                EVP_DigestFinal_ex(&md_ctx, q, (unsigned int *)&i);
                q += i;
                j += i;
            }
            if (RSA_sign(NID_md5_sha1, md_buf, j,
                         &(p[2]), &u, pkey->pkey.rsa) <= 0) {
                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_RSA);
                goto err;
            }
            s2n(u, p);
            n += u + 2;
        } else
#endif
        if (md) {
            if (SSL_USE_SIGALGS(s)) {
                if (!tls12_get_sigandhash(p, pkey, md)) {
                    al = SSL_AD_INTERNAL_ERROR;
                    SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                           ERR_R_INTERNAL_ERROR);
                    goto f_err;
                }
                p += 2;
            }
#ifdef SSL_DEBUG
            fprintf(stderr, "Using hash %s\n", EVP_MD_name(md));
#endif
            EVP_SignInit_ex(&md_ctx, md, NULL);
            EVP_SignUpdate(&md_ctx, &(s->s3->client_random[0]),
                           SSL3_RANDOM_SIZE);
            EVP_SignUpdate(&md_ctx, &(s->s3->server_random[0]),
                           SSL3_RANDOM_SIZE);
            EVP_SignUpdate(&md_ctx, d, n);
            if (!EVP_SignFinal(&md_ctx, &(p[2]),
                               (unsigned int *)&i, pkey)) {
                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_EVP);
                goto err;
            }
            s2n(i, p);
            n += i + 2;
            if (SSL_USE_SIGALGS(s))
                n += 2;
        } else {
            al = SSL_AD_HANDSHAKE_FAILURE;
            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,
                   SSL_R_UNKNOWN_PKEY_TYPE);
            goto f_err;
        }
    }
    if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_KEY_EXCHANGE, n)) {
        al = SSL_AD_HANDSHAKE_FAILURE;
        SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
        goto f_err;
    }
    EVP_MD_CTX_cleanup(&md_ctx);
    return 1;
 f_err:
    ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
#ifndef OPENSSL_NO_EC
    OPENSSL_free(encodedPoint);
    BN_CTX_free(bn_ctx);
#endif
    EVP_MD_CTX_cleanup(&md_ctx);
    statem_set_error(s);
    return 0;
}
['int tls_construct_server_key_exchange(SSL *s)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char *q;\n    int j, num;\n    RSA *rsa;\n    unsigned char md_buf[MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH];\n    unsigned int u;\n#endif\n#ifndef OPENSSL_NO_DH\n    DH *dh = NULL, *dhp;\n#endif\n#ifndef OPENSSL_NO_EC\n    EC_KEY *ecdh = NULL, *ecdhp;\n    unsigned char *encodedPoint = NULL;\n    int encodedlen = 0;\n    int curve_id = 0;\n    BN_CTX *bn_ctx = NULL;\n#endif\n    EVP_PKEY *pkey;\n    const EVP_MD *md = NULL;\n    unsigned char *p, *d;\n    int al, i;\n    unsigned long type;\n    int n;\n    CERT *cert;\n    BIGNUM *r[4];\n    int nr[4], kn;\n    BUF_MEM *buf;\n    EVP_MD_CTX md_ctx;\n    EVP_MD_CTX_init(&md_ctx);\n    type = s->s3->tmp.new_cipher->algorithm_mkey;\n    cert = s->cert;\n    buf = s->init_buf;\n    r[0] = r[1] = r[2] = r[3] = NULL;\n    n = 0;\n#ifndef OPENSSL_NO_PSK\n    if (type & SSL_PSK) {\n        n += 2;\n        if (s->cert->psk_identity_hint)\n            n += strlen(s->cert->psk_identity_hint);\n    }\n    if (type & (SSL_kPSK | SSL_kRSAPSK)) {\n    } else\n#endif\n#ifndef OPENSSL_NO_RSA\n    if (type & SSL_kRSA) {\n        rsa = cert->rsa_tmp;\n        if ((rsa == NULL) && (s->cert->rsa_tmp_cb != NULL)) {\n            rsa = s->cert->rsa_tmp_cb(s,\n                                      SSL_C_IS_EXPORT(s->s3->\n                                                      tmp.new_cipher),\n                                      SSL_C_EXPORT_PKEYLENGTH(s->s3->\n                                                              tmp.new_cipher));\n            if (rsa == NULL) {\n                al = SSL_AD_HANDSHAKE_FAILURE;\n                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                       SSL_R_ERROR_GENERATING_TMP_RSA_KEY);\n                goto f_err;\n            }\n            RSA_up_ref(rsa);\n            cert->rsa_tmp = rsa;\n        }\n        if (rsa == NULL) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   SSL_R_MISSING_TMP_RSA_KEY);\n            goto f_err;\n        }\n        r[0] = rsa->n;\n        r[1] = rsa->e;\n        s->s3->tmp.use_rsa_tmp = 1;\n    } else\n#endif\n#ifndef OPENSSL_NO_DH\n    if (type & (SSL_kDHE | SSL_kDHEPSK)) {\n        if (s->cert->dh_tmp_auto) {\n            dhp = ssl_get_auto_dh(s);\n            if (dhp == NULL) {\n                al = SSL_AD_INTERNAL_ERROR;\n                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                       ERR_R_INTERNAL_ERROR);\n                goto f_err;\n            }\n        } else\n            dhp = cert->dh_tmp;\n        if ((dhp == NULL) && (s->cert->dh_tmp_cb != NULL))\n            dhp = s->cert->dh_tmp_cb(s,\n                                     SSL_C_IS_EXPORT(s->s3->\n                                                     tmp.new_cipher),\n                                     SSL_C_EXPORT_PKEYLENGTH(s->s3->\n                                                             tmp.new_cipher));\n        if (dhp == NULL) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   SSL_R_MISSING_TMP_DH_KEY);\n            goto f_err;\n        }\n        if (!ssl_security(s, SSL_SECOP_TMP_DH,\n                          DH_security_bits(dhp), 0, dhp)) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   SSL_R_DH_KEY_TOO_SMALL);\n            goto f_err;\n        }\n        if (s->s3->tmp.dh != NULL) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        if (s->cert->dh_tmp_auto)\n            dh = dhp;\n        else if ((dh = DHparams_dup(dhp)) == NULL) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);\n            goto err;\n        }\n        s->s3->tmp.dh = dh;\n        if ((dhp->pub_key == NULL ||\n             dhp->priv_key == NULL ||\n             (s->options & SSL_OP_SINGLE_DH_USE))) {\n            if (!DH_generate_key(dh)) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);\n                goto err;\n            }\n        } else {\n            dh->pub_key = BN_dup(dhp->pub_key);\n            dh->priv_key = BN_dup(dhp->priv_key);\n            if ((dh->pub_key == NULL) || (dh->priv_key == NULL)) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_DH_LIB);\n                goto err;\n            }\n        }\n        r[0] = dh->p;\n        r[1] = dh->g;\n        r[2] = dh->pub_key;\n    } else\n#endif\n#ifndef OPENSSL_NO_EC\n    if (type & (SSL_kECDHE | SSL_kECDHEPSK)) {\n        const EC_GROUP *group;\n        ecdhp = cert->ecdh_tmp;\n        if (s->cert->ecdh_tmp_auto) {\n            int nid = tls1_shared_curve(s, -2);\n            if (nid != NID_undef)\n                ecdhp = EC_KEY_new_by_curve_name(nid);\n        } else if ((ecdhp == NULL) && s->cert->ecdh_tmp_cb) {\n            ecdhp = s->cert->ecdh_tmp_cb(s,\n                                         SSL_C_IS_EXPORT(s->s3->\n                                                         tmp.new_cipher),\n                                         SSL_C_EXPORT_PKEYLENGTH(s->\n                                                                 s3->tmp.new_cipher));\n        }\n        if (ecdhp == NULL) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   SSL_R_MISSING_TMP_ECDH_KEY);\n            goto f_err;\n        }\n        if (s->s3->tmp.ecdh != NULL) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        if (ecdhp == NULL) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);\n            goto err;\n        }\n        if (s->cert->ecdh_tmp_auto)\n            ecdh = ecdhp;\n        else if ((ecdh = EC_KEY_dup(ecdhp)) == NULL) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);\n            goto err;\n        }\n        s->s3->tmp.ecdh = ecdh;\n        if ((EC_KEY_get0_public_key(ecdh) == NULL) ||\n            (EC_KEY_get0_private_key(ecdh) == NULL) ||\n            (s->options & SSL_OP_SINGLE_ECDH_USE)) {\n            if (!EC_KEY_generate_key(ecdh)) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                       ERR_R_ECDH_LIB);\n                goto err;\n            }\n        }\n        if (((group = EC_KEY_get0_group(ecdh)) == NULL) ||\n            (EC_KEY_get0_public_key(ecdh) == NULL) ||\n            (EC_KEY_get0_private_key(ecdh) == NULL)) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);\n            goto err;\n        }\n        if (SSL_C_IS_EXPORT(s->s3->tmp.new_cipher) &&\n            (EC_GROUP_get_degree(group) > 163)) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER);\n            goto err;\n        }\n        if ((curve_id =\n             tls1_ec_nid2curve_id(EC_GROUP_get_curve_name(group)))\n            == 0) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   SSL_R_UNSUPPORTED_ELLIPTIC_CURVE);\n            goto err;\n        }\n        encodedlen = EC_POINT_point2oct(group,\n                                        EC_KEY_get0_public_key(ecdh),\n                                        POINT_CONVERSION_UNCOMPRESSED,\n                                        NULL, 0, NULL);\n        encodedPoint = (unsigned char *)\n            OPENSSL_malloc(encodedlen * sizeof(unsigned char));\n        bn_ctx = BN_CTX_new();\n        if ((encodedPoint == NULL) || (bn_ctx == NULL)) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        encodedlen = EC_POINT_point2oct(group,\n                                        EC_KEY_get0_public_key(ecdh),\n                                        POINT_CONVERSION_UNCOMPRESSED,\n                                        encodedPoint, encodedlen, bn_ctx);\n        if (encodedlen == 0) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_ECDH_LIB);\n            goto err;\n        }\n        BN_CTX_free(bn_ctx);\n        bn_ctx = NULL;\n        n += 4 + encodedlen;\n        r[0] = NULL;\n        r[1] = NULL;\n        r[2] = NULL;\n        r[3] = NULL;\n    } else\n#endif\n#ifndef OPENSSL_NO_SRP\n    if (type & SSL_kSRP) {\n        if ((s->srp_ctx.N == NULL) ||\n            (s->srp_ctx.g == NULL) ||\n            (s->srp_ctx.s == NULL) || (s->srp_ctx.B == NULL)) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   SSL_R_MISSING_SRP_PARAM);\n            goto err;\n        }\n        r[0] = s->srp_ctx.N;\n        r[1] = s->srp_ctx.g;\n        r[2] = s->srp_ctx.s;\n        r[3] = s->srp_ctx.B;\n    } else\n#endif\n    {\n        al = SSL_AD_HANDSHAKE_FAILURE;\n        SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n               SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);\n        goto f_err;\n    }\n    for (i = 0; i < 4 && r[i] != NULL; i++) {\n        nr[i] = BN_num_bytes(r[i]);\n#ifndef OPENSSL_NO_SRP\n        if ((i == 2) && (type & SSL_kSRP))\n            n += 1 + nr[i];\n        else\n#endif\n            n += 2 + nr[i];\n    }\n    if (!(s->s3->tmp.new_cipher->algorithm_auth & (SSL_aNULL|SSL_aSRP))\n        && !(s->s3->tmp.new_cipher->algorithm_mkey & SSL_PSK)) {\n        if ((pkey = ssl_get_sign_pkey(s, s->s3->tmp.new_cipher, &md))\n            == NULL) {\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n        kn = EVP_PKEY_size(pkey);\n    } else {\n        pkey = NULL;\n        kn = 0;\n    }\n    if (!BUF_MEM_grow_clean(buf, n + SSL_HM_HEADER_LENGTH(s) + kn)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_BUF);\n        goto err;\n    }\n    d = p = ssl_handshake_start(s);\n#ifndef OPENSSL_NO_PSK\n    if (type & SSL_PSK) {\n        if (s->cert->psk_identity_hint) {\n            s2n(strlen(s->cert->psk_identity_hint), p);\n            strncpy((char *)p, s->cert->psk_identity_hint,\n                    strlen(s->cert->psk_identity_hint));\n            p += strlen(s->cert->psk_identity_hint);\n        } else {\n            s2n(0, p);\n        }\n    }\n#endif\n    for (i = 0; i < 4 && r[i] != NULL; i++) {\n#ifndef OPENSSL_NO_SRP\n        if ((i == 2) && (type & SSL_kSRP)) {\n            *p = nr[i];\n            p++;\n        } else\n#endif\n            s2n(nr[i], p);\n        BN_bn2bin(r[i], p);\n        p += nr[i];\n    }\n#ifndef OPENSSL_NO_EC\n    if (type & (SSL_kECDHE | SSL_kECDHEPSK)) {\n        *p = NAMED_CURVE_TYPE;\n        p += 1;\n        *p = 0;\n        p += 1;\n        *p = curve_id;\n        p += 1;\n        *p = encodedlen;\n        p += 1;\n        memcpy(p, encodedPoint, encodedlen);\n        OPENSSL_free(encodedPoint);\n        encodedPoint = NULL;\n        p += encodedlen;\n    }\n#endif\n    if (pkey != NULL) {\n#ifndef OPENSSL_NO_RSA\n        if (pkey->type == EVP_PKEY_RSA && !SSL_USE_SIGALGS(s)) {\n            q = md_buf;\n            j = 0;\n            for (num = 2; num > 0; num--) {\n                EVP_MD_CTX_set_flags(&md_ctx,\n                                     EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);\n                EVP_DigestInit_ex(&md_ctx, (num == 2)\n                                  ? s->ctx->md5 : s->ctx->sha1, NULL);\n                EVP_DigestUpdate(&md_ctx, &(s->s3->client_random[0]),\n                                 SSL3_RANDOM_SIZE);\n                EVP_DigestUpdate(&md_ctx, &(s->s3->server_random[0]),\n                                 SSL3_RANDOM_SIZE);\n                EVP_DigestUpdate(&md_ctx, d, n);\n                EVP_DigestFinal_ex(&md_ctx, q, (unsigned int *)&i);\n                q += i;\n                j += i;\n            }\n            if (RSA_sign(NID_md5_sha1, md_buf, j,\n                         &(p[2]), &u, pkey->pkey.rsa) <= 0) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_RSA);\n                goto err;\n            }\n            s2n(u, p);\n            n += u + 2;\n        } else\n#endif\n        if (md) {\n            if (SSL_USE_SIGALGS(s)) {\n                if (!tls12_get_sigandhash(p, pkey, md)) {\n                    al = SSL_AD_INTERNAL_ERROR;\n                    SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                           ERR_R_INTERNAL_ERROR);\n                    goto f_err;\n                }\n                p += 2;\n            }\n#ifdef SSL_DEBUG\n            fprintf(stderr, "Using hash %s\\n", EVP_MD_name(md));\n#endif\n            EVP_SignInit_ex(&md_ctx, md, NULL);\n            EVP_SignUpdate(&md_ctx, &(s->s3->client_random[0]),\n                           SSL3_RANDOM_SIZE);\n            EVP_SignUpdate(&md_ctx, &(s->s3->server_random[0]),\n                           SSL3_RANDOM_SIZE);\n            EVP_SignUpdate(&md_ctx, d, n);\n            if (!EVP_SignFinal(&md_ctx, &(p[2]),\n                               (unsigned int *)&i, pkey)) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_LIB_EVP);\n                goto err;\n            }\n            s2n(i, p);\n            n += i + 2;\n            if (SSL_USE_SIGALGS(s))\n                n += 2;\n        } else {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE,\n                   SSL_R_UNKNOWN_PKEY_TYPE);\n            goto f_err;\n        }\n    }\n    if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_KEY_EXCHANGE, n)) {\n        al = SSL_AD_HANDSHAKE_FAILURE;\n        SSLerr(SSL_F_TLS_CONSTRUCT_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    }\n    EVP_MD_CTX_cleanup(&md_ctx);\n    return 1;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n err:\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(encodedPoint);\n    BN_CTX_free(bn_ctx);\n#endif\n    EVP_MD_CTX_cleanup(&md_ctx);\n    statem_set_error(s);\n    return 0;\n}']