Commit 9013ad7506 for openssl.org

commit 9013ad7506f61f8b48bec5314f6fb0067f7b25b9
Author: Paul Dale <paul.dale@oracle.com>
Date:   Fri Oct 23 13:12:32 2026 +1100

    test: check FIPS RNG health test cutoffs

    Verify that RCT accepts seven equal bytes and rejects eight. Verify that
    APT accepts 34 anchor occurrences in a 512-byte window and rejects 35,
    with the final occurrence at the end of the window.

    Assisted-by: ChatGPT:gpt-6-Sol
    Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Merge-date: Fri Oct 30 08:59:59 2026
    Merged-from: https://github.com/openssl/openssl/pull/33289

diff --git a/test/rand_test.c b/test/rand_test.c
index 022f2d1a14..47ff7286be 100644
--- a/test/rand_test.c
+++ b/test/rand_test.c
@@ -254,16 +254,26 @@ static int fips_health_tests(void)
     if (!TEST_true(fips_health_test_one(buf, i, i)))
         return 0;

-    /* Verify RCT can fail */
-    for (i = 0; i < 20; i++)
-        buf[i] = 0xff & (i > 10 ? 200 : i);
-    if (!TEST_false(fips_health_test_one(buf, i, i)))
+    /* Verify RCT accepts seven equal bytes and rejects eight */
+    memset(buf, 200, 8);
+    if (!TEST_true(fips_health_test_one(buf, 7, 7))
+        || !TEST_false(fips_health_test_one(buf, 8, 8)))
         return 0;

-    /* Verify APT can fail */
-    for (i = 0; i < sizeof(buf); i++)
-        buf[i] = 0xff & (i >= 512 && i % 8 == 0 ? 0x80 : i);
-    if (!TEST_false(fips_health_test_one(buf, i, i)))
+    /*
+     * Verify APT accepts 34 anchor occurrences in a 512-byte window,
+     * including the first byte.  Space them apart to avoid an RCT failure.
+     */
+    for (i = 0; i < 512; i++)
+        buf[i] = 1 + i % 255;
+    for (i = 0; i < 34; i++)
+        buf[15 * i] = 0;
+    if (!TEST_true(fips_health_test_one(buf, 512, 512)))
+        return 0;
+
+    /* A 35th anchor occurrence at the end of the window must fail */
+    buf[511] = 0;
+    if (!TEST_false(fips_health_test_one(buf, 512, 512)))
         return 0;
     return 1;
 }