int ctr_generate(RAND_DRBG *drbg,
                 unsigned char *out, size_t outlen,
                 const unsigned char *adin, size_t adinlen)
{
    RAND_DRBG_CTR *ctr = &drbg->ctr;
    if (adin != NULL && adinlen != 0) {
        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {
            adin = NULL;
            adinlen = 1;
        }
    } else {
        adinlen = 0;
    }
    for ( ; ; ) {
        inc_128(ctr);
        if (outlen < 16) {
            AES_encrypt(ctr->V, ctr->K, &ctr->ks);
            memcpy(out, ctr->K, outlen);
            break;
        }
        AES_encrypt(ctr->V, out, &ctr->ks);
        out += 16;
        outlen -= 16;
        if (outlen == 0)
            break;
    }
    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
    return 1;
}
['static int tls_process_cke_rsa(SSL *s, PACKET *pkt)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];\n    int decrypt_len;\n    unsigned char decrypt_good, version_good;\n    size_t j, padding_len;\n    PACKET enc_premaster;\n    RSA *rsa = NULL;\n    unsigned char *rsa_decrypt = NULL;\n    int ret = 0;\n    rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA].privatekey);\n    if (rsa == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 SSL_R_MISSING_RSA_CERTIFICATE);\n        return 0;\n    }\n    if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) {\n        enc_premaster = *pkt;\n    } else {\n        if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)\n            || PACKET_remaining(pkt) != 0) {\n            SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                     SSL_R_LENGTH_MISMATCH);\n            return 0;\n        }\n    }\n    if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 RSA_R_KEY_SIZE_TOO_SMALL);\n        return 0;\n    }\n    rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));\n    if (rsa_decrypt == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    if (ssl_randbytes(s, rand_premaster_secret,\n                      sizeof(rand_premaster_secret)) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    decrypt_len = (int)RSA_private_decrypt((int)PACKET_remaining(&enc_premaster),\n                                           PACKET_data(&enc_premaster),\n                                           rsa_decrypt, rsa, RSA_NO_PADDING);\n    if (decrypt_len < 0) {\n        SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) {\n        SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 SSL_R_DECRYPTION_FAILED);\n        goto err;\n    }\n    padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH;\n    decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &\n        constant_time_eq_int_8(rsa_decrypt[1], 2);\n    for (j = 2; j < padding_len - 1; j++) {\n        decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);\n    }\n    decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);\n    version_good =\n        constant_time_eq_8(rsa_decrypt[padding_len],\n                           (unsigned)(s->client_version >> 8));\n    version_good &=\n        constant_time_eq_8(rsa_decrypt[padding_len + 1],\n                           (unsigned)(s->client_version & 0xff));\n    if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {\n        unsigned char workaround_good;\n        workaround_good = constant_time_eq_8(rsa_decrypt[padding_len],\n                                             (unsigned)(s->version >> 8));\n        workaround_good &=\n            constant_time_eq_8(rsa_decrypt[padding_len + 1],\n                               (unsigned)(s->version & 0xff));\n        version_good |= workaround_good;\n    }\n    decrypt_good &= version_good;\n    for (j = 0; j < sizeof(rand_premaster_secret); j++) {\n        rsa_decrypt[padding_len + j] =\n            constant_time_select_8(decrypt_good,\n                                   rsa_decrypt[padding_len + j],\n                                   rand_premaster_secret[j]);\n    }\n    if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len,\n                                    sizeof(rand_premaster_secret), 0)) {\n        goto err;\n    }\n    ret = 1;\n err:\n    OPENSSL_free(rsa_decrypt);\n    return ret;\n#else\n    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n             ERR_R_INTERNAL_ERROR);\n    return 0;\n#endif\n}', 'int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)\n{\n    if (s->drbg != NULL) {\n         return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);\n    }\n    return RAND_bytes(rnd, (int)size);\n}', 'int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,\n                       int prediction_resistance,\n                       const unsigned char *adin, size_t adinlen)\n{\n    int reseed_required = 0;\n    if (drbg->state != DRBG_READY) {\n        rand_drbg_restart(drbg, NULL, 0, 0);\n        if (drbg->state == DRBG_ERROR) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);\n            return 0;\n        }\n        if (drbg->state == DRBG_UNINITIALISED) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);\n            return 0;\n        }\n    }\n    if (outlen > drbg->max_request) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);\n        return 0;\n    }\n    if (adinlen > drbg->max_adinlen) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);\n        return 0;\n    }\n    if (drbg->fork_count != rand_fork_count) {\n        drbg->fork_count = rand_fork_count;\n        reseed_required = 1;\n    }\n    if (drbg->reseed_counter >= drbg->reseed_interval)\n        reseed_required = 1;\n    if (reseed_required || prediction_resistance) {\n        if (!RAND_DRBG_reseed(drbg, adin, adinlen)) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);\n            return 0;\n        }\n        adin = NULL;\n        adinlen = 0;\n    }\n    if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {\n        drbg->state = DRBG_ERROR;\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);\n        return 0;\n    }\n    drbg->reseed_counter++;\n    return 1;\n}', 'int ctr_generate(RAND_DRBG *drbg,\n                 unsigned char *out, size_t outlen,\n                 const unsigned char *adin, size_t adinlen)\n{\n    RAND_DRBG_CTR *ctr = &drbg->ctr;\n    if (adin != NULL && adinlen != 0) {\n        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {\n            adin = NULL;\n            adinlen = 1;\n        }\n    } else {\n        adinlen = 0;\n    }\n    for ( ; ; ) {\n        inc_128(ctr);\n        if (outlen < 16) {\n            AES_encrypt(ctr->V, ctr->K, &ctr->ks);\n            memcpy(out, ctr->K, outlen);\n            break;\n        }\n        AES_encrypt(ctr->V, out, &ctr->ks);\n        out += 16;\n        outlen -= 16;\n        if (outlen == 0)\n            break;\n    }\n    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n    return 1;\n}']