wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

key zeroisation for pvkfmt now done on all branch paths

Browse source 
Reviewed-by: Paul Yang <yang.yang@baishancloud.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7107)
This commit is contained in:
Shane Lontis 2018-09-04 14:31:11 +10:00 committed by Pauli
parent 8f39d8af7d
commit 0239283d99
1 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
crypto/pem/pvkfmt.c
View file

@ -676,11 +676,11 @@ static EVP_PKEY *do_PVK_body(const unsigned char **in,
const unsigned char *p = *in; const unsigned char *p = *in;
unsigned int magic; unsigned int magic;
unsigned char *enctmp = NULL, *q; unsigned char *enctmp = NULL, *q;
unsigned char keybuf[20];
EVP_CIPHER_CTX *cctx = EVP_CIPHER_CTX_new(); EVP_CIPHER_CTX *cctx = EVP_CIPHER_CTX_new();
if (saltlen) { if (saltlen) {
char psbuf[PEM_BUFSIZE]; char psbuf[PEM_BUFSIZE];
unsigned char keybuf[20];
int enctmplen, inlen; int enctmplen, inlen;
if (cb) if (cb)
inlen = cb(psbuf, PEM_BUFSIZE, 0, u); inlen = cb(psbuf, PEM_BUFSIZE, 0, u);
@ -720,7 +720,6 @@ static EVP_PKEY *do_PVK_body(const unsigned char **in,
memset(keybuf + 5, 0, 11); memset(keybuf + 5, 0, 11);
if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL)) if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))
goto err; goto err;
OPENSSL_cleanse(keybuf, 20);
if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen)) if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))
goto err; goto err;
if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen)) if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))
@ -730,15 +729,17 @@ static EVP_PKEY *do_PVK_body(const unsigned char **in,
PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_DECRYPT); PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_DECRYPT);
goto err; goto err;
} }
} else }
OPENSSL_cleanse(keybuf, 20);
p = enctmp; p = enctmp;
} }
ret = b2i_PrivateKey(&p, keylen); ret = b2i_PrivateKey(&p, keylen);
err: err:
EVP_CIPHER_CTX_free(cctx); EVP_CIPHER_CTX_free(cctx);
if (enctmp != NULL) {
OPENSSL_cleanse(keybuf, sizeof(keybuf));
OPENSSL_free(enctmp); OPENSSL_free(enctmp);
}
return ret; return ret;
} }