#170 return value of RAND_bytes() is not checked

[Kristýna Streitová]

In common/transformation_ssl.c dump uses RAND_bytes() function without checking of the return value [1].

It seems that this code is not currently used (transformation_ssl_factory() function is currently not called) but if it will be used in the future, this can be considered security issue (resulting in a useless salt).

Thanks Daniel Molkentin (daniel.molkentin@suse.com) for finding this potential issue.

[1] https://sourceforge.net/p/dump/code/ci/master/tree/common/transformation_ssl.c#l518

[Mike Frysinger]

thanks, should be fixed in faa1df059b565cca2532dac2a8f93678f8fe163b