/* Provenance: openssl/openssl rsasve_generate (fixed).
 * repo: openssl/openssl
 * commit: eed200f58cd8645ed77e46b7e9f764e284df379e
 * parent: a91e537d16d74050dbde50bb0dfb1fe9930f0521
 * commit_url: https://github.com/openssl/openssl/commit/eed200f58cd8645ed77e46b7e9f764e284df379e
 * cve: CVE-2026-31790
 * license: Apache-2.0
 * function: rsasve_generate
 * relpath: providers/implementations/kem/rsa_kem.c
 */

static int rsasve_generate(PROV_RSA_CTX *prsactx,
    unsigned char *out, size_t *outlen,
    unsigned char *secret, size_t *secretlen)
{
    int ret;
    size_t nlen;

    /* Step (1): nlen = Ceil(len(n)/8) */
    nlen = RSA_size(prsactx->rsa);

    if (out == NULL) {
        if (nlen == 0) {
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY);
            return 0;
        }
        if (outlen == NULL && secretlen == NULL)
            return 0;
        if (outlen != NULL)
            *outlen = nlen;
        if (secretlen != NULL)
            *secretlen = nlen;
        return 1;
    }

    /*
     * If outlen is specified, then it must report the length
     * of the out buffer on input so that we can confirm
     * its size is sufficient for encapsulation
     */
    if (outlen != NULL && *outlen < nlen) {
        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
        return 0;
    }

    /*
     * Step (2): Generate a random byte string z of nlen bytes where
     *            1 < z < n - 1
     */
    if (!rsasve_gen_rand_bytes(prsactx->rsa, secret, nlen))
        return 0;

    /* Step(3): out = RSAEP((n,e), z) */
    ret = RSA_public_encrypt((int)nlen, secret, out, prsactx->rsa,
        RSA_NO_PADDING);
    if (ret <= 0 || ret != (int)nlen) {
        OPENSSL_cleanse(secret, nlen);
        return 0;
    }

    if (outlen != NULL)
        *outlen = nlen;
    if (secretlen != NULL)
        *secretlen = nlen;

    return 1;
}