diff options
author | Matt Caswell <matt@openssl.org> | 2015-03-09 13:59:58 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2015-03-11 10:40:44 +0000 |
commit | c9dd49a751d4e73e6d891c006bb1d835ebfb8493 (patch) | |
tree | 78c55596a1e6469c5d01e1a0d6a94658f7e72c9a | |
parent | 06c6a2b4a3a6e64303caa256398dd2dc16f9c35a (diff) |
Cleanse buffers
Cleanse various intermediate buffers used by the PRF.
Reviewed-by: Richard Levitte <levitte@openssl.org>
-rw-r--r-- | ssl/s3_enc.c | 1 | ||||
-rw-r--r-- | ssl/t1_enc.c | 5 |
2 files changed, 6 insertions, 0 deletions
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index 8dda5d0735..83a576ad1a 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -871,6 +871,7 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, s, s->msg_callback_arg); } #endif + OPENSSL_cleanse(buf, sizeof buf); return (ret); } diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index 6fad8be356..1833eb7646 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -949,6 +949,8 @@ int tls1_final_finish_mac(SSL *s, const char *str, int slen, s->session->master_key, s->session->master_key_length, out, buf2, sizeof buf2)) return 0; + OPENSSL_cleanse(hash, hashlen); + OPENSSL_cleanse(buf2, sizeof(buf2)); return sizeof buf2; } @@ -1112,6 +1114,7 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, s->s3->server_random, SSL3_RANDOM_SIZE, NULL, 0, p, len, s->session->master_key, buff, sizeof buff); } + OPENSSL_cleanse(buff, sizeof buff); #ifdef SSL_DEBUG fprintf(stderr, "Premaster Secret:\n"); BIO_dump_fp(stderr, (char *)p, len); @@ -1225,6 +1228,8 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, NULL, 0, s->session->master_key, s->session->master_key_length, out, buff, olen); + OPENSSL_cleanse(val, vallen); + OPENSSL_cleanse(buff, olen); #ifdef KSSL_DEBUG fprintf(stderr, "tls1_export_keying_material() complete\n"); |