prevent RandReader.Read argument from escaping to the heap

cgo_go124.go

@@ -0,0 +1,7 @@
+//go:build go1.24 && !cmd_go_bootstrap
+
+package openssl
+
+// #cgo noescape go_openssl_RAND_bytes
+// #cgo nocallback go_openssl_RAND_bytes
+import "C"

rand_test.go

@@ -1,6 +1,9 @@
 package openssl_test
 
 import (
+	"go/version"
+	"runtime"
+	"strings"
 	"testing"
 
 	"github.com/golang-fips/openssl/v2"
@@ -12,3 +15,19 @@ func TestRand(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestAllocations(t *testing.T) {
+	n := int(testing.AllocsPerRun(10, func() {
+		buf := make([]byte, 32)
+		openssl.RandReader.Read(buf)
+		sink ^= buf[0]
+	}))
+	want := 1
+	ver := strings.TrimPrefix(runtime.Version(), "devel ")
+	if version.Compare(ver, "go1.24") >= 0 {
+		want = 0
+	}
+	if n > want {
+		t.Errorf("allocs = %d, want %d", n, want)
+	}
+}