Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure

Signed-off-by: Gilles Peskine <[email protected]>

ChangeLog.d/ssl_tls13_prepare_new_session_ticket-psa_get_random.txt

@@ -0,0 +1,5 @@
+Security
+   * Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return
+     1 instead of an error code if the random generator fails if a server
+     calls these functions before the end of a TLS 1.3 handshake.
+     Reported by Mohammad Seet (mhdsait101). CVE-2026-40294

library/ssl_tls13_server.c

@@ -3204,9 +3204,10 @@ static int ssl_tls13_prepare_new_session_ticket(mbedtls_ssl_context *ssl,
 #endif
 
     /* Generate ticket_age_add */
-    if ((ret = ssl->conf->f_rng(ssl->conf->p_rng,
-                                (unsigned char *) &session->ticket_age_add,
-                                sizeof(session->ticket_age_add)) != 0)) {
+    ret = ssl->conf->f_rng(ssl->conf->p_rng,
+                           (unsigned char *) &session->ticket_age_add,
+                           sizeof(session->ticket_age_add));
+    if (ret != 0) {
         MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_age_add", ret);
         return ret;
     }