wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cleanse buffers

Browse source 
Cleanse various intermediate buffers used by the PRF.

Reviewed-by: Richard Levitte <levitte@openssl.org>
This commit is contained in:
Matt Caswell 2015-03-09 13:59:58 +00:00
parent 06c6a2b4a3
commit c9dd49a751
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
ssl/s3_enc.c
View file

@ -871,6 +871,7 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
s, s->msg_callback_arg); s, s->msg_callback_arg);
} }
#endif #endif
OPENSSL_cleanse(buf, sizeof buf);
return (ret); return (ret);
} }

5
ssl/t1_enc.c
View file

@ -949,6 +949,8 @@ int tls1_final_finish_mac(SSL *s, const char *str, int slen,
s->session->master_key, s->session->master_key_length, s->session->master_key, s->session->master_key_length,
out, buf2, sizeof buf2)) out, buf2, sizeof buf2))
return 0; return 0;
OPENSSL_cleanse(hash, hashlen);
OPENSSL_cleanse(buf2, sizeof(buf2));
return sizeof buf2; return sizeof buf2;
} }
@ -1112,6 +1114,7 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
s->s3->server_random, SSL3_RANDOM_SIZE, s->s3->server_random, SSL3_RANDOM_SIZE,
NULL, 0, p, len, s->session->master_key, buff, sizeof buff); NULL, 0, p, len, s->session->master_key, buff, sizeof buff);
} }
OPENSSL_cleanse(buff, sizeof buff);
#ifdef SSL_DEBUG #ifdef SSL_DEBUG
fprintf(stderr, "Premaster Secret:\n"); fprintf(stderr, "Premaster Secret:\n");
BIO_dump_fp(stderr, (char *)p, len); BIO_dump_fp(stderr, (char *)p, len);
@ -1225,6 +1228,8 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
NULL, 0, NULL, 0,
s->session->master_key, s->session->master_key_length, s->session->master_key, s->session->master_key_length,
out, buff, olen); out, buff, olen);
OPENSSL_cleanse(val, vallen);
OPENSSL_cleanse(buff, olen);
#ifdef KSSL_DEBUG #ifdef KSSL_DEBUG
fprintf(stderr, "tls1_export_keying_material() complete\n"); fprintf(stderr, "tls1_export_keying_material() complete\n");