From 58d8a271ab1eb38fc2983519fb3c37a900df41cf Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Mon, 9 Mar 2015 13:59:58 +0000 Subject: Cleanse buffers Cleanse various intermediate buffers used by the PRF (backported version from master). Reviewed-by: Richard Levitte (cherry picked from commit 35fafc4dbc0b3a717ad1b208fe2867e8c64867de) Conflicts: ssl/s3_enc.c --- ssl/s3_enc.c | 1 + ssl/t1_enc.c | 5 +++++ 2 files changed, 6 insertions(+) (limited to 'ssl') diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index b4a1456781..152f40db58 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -841,6 +841,7 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, ret += n; } EVP_MD_CTX_cleanup(&ctx); + OPENSSL_cleanse(buf, sizeof buf); return (ret); } diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index 0d70116a13..fa1c002bf3 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -958,6 +958,8 @@ int tls1_final_finish_mac(SSL *s, err = 1; EVP_MD_CTX_cleanup(&ctx); + OPENSSL_cleanse(buf, (int)(q - buf)); + OPENSSL_cleanse(buf2, sizeof(buf2)); if (err) return 0; else @@ -1121,6 +1123,7 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, co, col, s->s3->server_random, SSL3_RANDOM_SIZE, so, sol, p, len, s->session->master_key, buff, sizeof buff); + OPENSSL_cleanse(buff, sizeof buff); #ifdef SSL_DEBUG fprintf(stderr, "Premaster Secret:\n"); BIO_dump_fp(stderr, (char *)p, len); @@ -1215,6 +1218,8 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, NULL, 0, s->session->master_key, s->session->master_key_length, out, buff, olen); + OPENSSL_cleanse(val, vallen); + OPENSSL_cleanse(buff, olen); #ifdef KSSL_DEBUG fprintf(stderr, "tls1_export_keying_material() complete\n"); -- cgit v1.2.1