diff options
author | Rich Salz <rsalz@openssl.org> | 2015-04-30 17:57:32 -0400 |
---|---|---|
committer | Rich Salz <rsalz@openssl.org> | 2015-04-30 17:57:32 -0400 |
commit | 4b45c6e52b208deff7da333d1c7f84bcd3986609 (patch) | |
tree | db26f7a51ad582f203dce2145a43c3e0d4376f69 /crypto | |
parent | 68dc682499ea3fe27d909c946d7abd39062d6efd (diff) |
free cleanup almost the finale
Add OPENSSL_clear_free which merges cleanse and free.
(Names was picked to be similar to BN_clear_free, etc.)
Removed OPENSSL_freeFunc macro.
Fixed the small simple ones that are left:
CRYPTO_free CRYPTO_free_locked OPENSSL_free_locked
Reviewed-by: Richard Levitte <levitte@openssl.org>
Diffstat (limited to 'crypto')
41 files changed, 90 insertions, 233 deletions
diff --git a/crypto/asn1/a_sign.c b/crypto/asn1/a_sign.c index 21cbe0c347..fb7536d84e 100644 --- a/crypto/asn1/a_sign.c +++ b/crypto/asn1/a_sign.c @@ -203,14 +203,8 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2, signature->flags |= ASN1_STRING_FLAG_BITS_LEFT; err: EVP_MD_CTX_cleanup(&ctx); - if (buf_in != NULL) { - OPENSSL_cleanse((char *)buf_in, (unsigned int)inl); - OPENSSL_free(buf_in); - } - if (buf_out != NULL) { - OPENSSL_cleanse((char *)buf_out, outll); - OPENSSL_free(buf_out); - } + OPENSSL_clear_free((char *)buf_in, (unsigned int)inl); + OPENSSL_clear_free((char *)buf_out, outll); return (outl); } @@ -319,13 +313,7 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, signature->flags |= ASN1_STRING_FLAG_BITS_LEFT; err: EVP_MD_CTX_cleanup(ctx); - if (buf_in != NULL) { - OPENSSL_cleanse((char *)buf_in, (unsigned int)inl); - OPENSSL_free(buf_in); - } - if (buf_out != NULL) { - OPENSSL_cleanse((char *)buf_out, outll); - OPENSSL_free(buf_out); - } + OPENSSL_clear_free((char *)buf_in, (unsigned int)inl); + OPENSSL_clear_free((char *)buf_out, outll); return (outl); } diff --git a/crypto/asn1/a_verify.c b/crypto/asn1/a_verify.c index 6023b148f0..b452999756 100644 --- a/crypto/asn1/a_verify.c +++ b/crypto/asn1/a_verify.c @@ -107,8 +107,7 @@ int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature, ret = EVP_VerifyInit_ex(&ctx, type, NULL) && EVP_VerifyUpdate(&ctx, (unsigned char *)buf_in, inl); - OPENSSL_cleanse(buf_in, (unsigned int)inl); - OPENSSL_free(buf_in); + OPENSSL_clear_free(buf_in, (unsigned int)inl); if (!ret) { ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_EVP_LIB); @@ -208,8 +207,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ret = EVP_DigestVerifyUpdate(&ctx, buf_in, inl); - OPENSSL_cleanse(buf_in, (unsigned int)inl); - OPENSSL_free(buf_in); + OPENSSL_clear_free(buf_in, (unsigned int)inl); if (!ret) { ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB); diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c index 10964646f2..4681154e38 100644 --- a/crypto/bn/bn_rand.c +++ b/crypto/bn/bn_rand.c @@ -187,10 +187,7 @@ static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom) goto err; ret = 1; err: - if (buf != NULL) { - OPENSSL_cleanse(buf, bytes); - OPENSSL_free(buf); - } + OPENSSL_clear_free(buf, bytes); bn_check_top(rnd); return (ret); } diff --git a/crypto/cms/cms_asn1.c b/crypto/cms/cms_asn1.c index 2b61768847..893ad4657b 100644 --- a/crypto/cms/cms_asn1.c +++ b/crypto/cms/cms_asn1.c @@ -251,16 +251,10 @@ static int cms_ri_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, EVP_PKEY_CTX_free(ktri->pctx); } else if (ri->type == CMS_RECIPINFO_KEK) { CMS_KEKRecipientInfo *kekri = ri->d.kekri; - if (kekri->key) { - OPENSSL_cleanse(kekri->key, kekri->keylen); - OPENSSL_free(kekri->key); - } + OPENSSL_clear_free(kekri->key, kekri->keylen); } else if (ri->type == CMS_RECIPINFO_PASS) { CMS_PasswordRecipientInfo *pwri = ri->d.pwri; - if (pwri->pass) { - OPENSSL_cleanse(pwri->pass, pwri->passlen); - OPENSSL_free(pwri->pass); - } + OPENSSL_clear_free(pwri->pass, pwri->passlen); } } return 1; diff --git a/crypto/cms/cms_enc.c b/crypto/cms/cms_enc.c index ffa85fc0dd..f1ac1d535b 100644 --- a/crypto/cms/cms_enc.c +++ b/crypto/cms/cms_enc.c @@ -164,8 +164,7 @@ BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec) goto err; } else { /* Use random key */ - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = tkey; ec->keylen = tkeylen; tkey = NULL; @@ -196,14 +195,10 @@ BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec) err: if (ec->key && !keep_key) { - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = NULL; } - if (tkey) { - OPENSSL_cleanse(tkey, tkeylen); - OPENSSL_free(tkey); - } + OPENSSL_clear_free(tkey, tkeylen); if (ok) return b; BIO_free(b); diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c index 98c1fe0120..d146f845e9 100644 --- a/crypto/cms/cms_env.c +++ b/crypto/cms/cms_env.c @@ -465,11 +465,7 @@ static int cms_RecipientInfo_ktri_decrypt(CMS_ContentInfo *cms, ret = 1; - if (ec->key) { - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); - } - + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = ek; ec->keylen = eklen; @@ -937,12 +933,9 @@ BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms) err: ec->cipher = NULL; - if (ec->key) { - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); - ec->key = NULL; - ec->keylen = 0; - } + OPENSSL_clear_free(ec->key, ec->keylen); + ec->key = NULL; + ec->keylen = 0; if (ok) return ret; BIO_free(ret); diff --git a/crypto/cms/cms_kari.c b/crypto/cms/cms_kari.c index 69a51157e1..17b62ddd8c 100644 --- a/crypto/cms/cms_kari.c +++ b/crypto/cms/cms_kari.c @@ -294,10 +294,7 @@ int CMS_RecipientInfo_kari_decrypt(CMS_ContentInfo *cms, if (!cms_kek_cipher(&cek, &ceklen, enckey, enckeylen, ri->d.kari, 0)) goto err; ec = cms->d.envelopedData->encryptedContentInfo; - if (ec->key) { - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); - } + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = cek; ec->keylen = ceklen; cek = NULL; diff --git a/crypto/cms/cms_pwri.c b/crypto/cms/cms_pwri.c index ece5ce3640..64165022f3 100644 --- a/crypto/cms/cms_pwri.c +++ b/crypto/cms/cms_pwri.c @@ -263,8 +263,7 @@ static int kek_unwrap_key(unsigned char *out, size_t *outlen, memcpy(out, tmp + 4, *outlen); rv = 1; err: - OPENSSL_cleanse(tmp, inlen); - OPENSSL_free(tmp); + OPENSSL_clear_free(tmp, inlen); return rv; } diff --git a/crypto/dh/dh_pmeth.c b/crypto/dh/dh_pmeth.c index 3fad0548a1..e3ebc0201d 100644 --- a/crypto/dh/dh_pmeth.c +++ b/crypto/dh/dh_pmeth.c @@ -477,10 +477,7 @@ static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, *keylen = dctx->kdf_outlen; ret = 1; err: - if (Z) { - OPENSSL_cleanse(Z, Zlen); - OPENSSL_free(Z); - } + OPENSSL_clear_free(Z, Zlen); return ret; } return 1; diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c index e7f80a8d62..d79f261f2a 100644 --- a/crypto/dsa/dsa_asn1.c +++ b/crypto/dsa/dsa_asn1.c @@ -188,10 +188,7 @@ int DSA_verify(int type, const unsigned char *dgst, int dgst_len, goto err; ret = DSA_do_verify(dgst, dgst_len, s, dsa); err: - if (derlen > 0) { - OPENSSL_cleanse(der, derlen); - OPENSSL_free(der); - } + OPENSSL_clear_free(der, derlen); DSA_SIG_free(s); return (ret); } diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c index b73263d6c1..dbd91d6f69 100644 --- a/crypto/ec/ec_key.c +++ b/crypto/ec/ec_key.c @@ -127,9 +127,7 @@ void EC_KEY_free(EC_KEY *r) EC_EX_DATA_free_all_data(&r->method_data); - OPENSSL_cleanse((void *)r, sizeof(EC_KEY)); - - OPENSSL_free(r); + OPENSSL_clear_free((void *)r, sizeof(EC_KEY)); } EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src) diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c index 0e850d699e..b2a5d79710 100644 --- a/crypto/ec/ec_lib.c +++ b/crypto/ec/ec_lib.c @@ -166,14 +166,8 @@ void EC_GROUP_clear_free(EC_GROUP *group) EC_POINT_clear_free(group->generator); BN_clear_free(group->order); BN_clear_free(group->cofactor); - - if (group->seed) { - OPENSSL_cleanse(group->seed, group->seed_len); - OPENSSL_free(group->seed); - } - - OPENSSL_cleanse(group, sizeof *group); - OPENSSL_free(group); + OPENSSL_clear_free(group->seed, group->seed_len); + OPENSSL_clear_free(group, sizeof *group); } int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src) @@ -751,8 +745,7 @@ void EC_POINT_clear_free(EC_POINT *point) point->meth->point_clear_finish(point); else if (point->meth->point_finish != 0) point->meth->point_finish(point); - OPENSSL_cleanse(point, sizeof *point); - OPENSSL_free(point); + OPENSSL_clear_free(point, sizeof *point); } int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src) diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c index 979b4540ef..6dabfc8d99 100644 --- a/crypto/ec/ec_mult.c +++ b/crypto/ec/ec_mult.c @@ -169,8 +169,7 @@ static void ec_pre_comp_clear_free(void *pre_) } OPENSSL_free(pre->points); } - OPENSSL_cleanse(pre, sizeof *pre); - OPENSSL_free(pre); + OPENSSL_clear_free(pre, sizeof *pre); } /* diff --git a/crypto/ec/ec_pmeth.c b/crypto/ec/ec_pmeth.c index 37f8fa1316..5b3d197b69 100644 --- a/crypto/ec/ec_pmeth.c +++ b/crypto/ec/ec_pmeth.c @@ -268,10 +268,7 @@ static int pkey_ec_kdf_derive(EVP_PKEY_CTX *ctx, rv = 1; err: - if (ktmp) { - OPENSSL_cleanse(ktmp, ktmplen); - OPENSSL_free(ktmp); - } + OPENSSL_clear_free(ktmp, ktmplen); return rv; } #endif diff --git a/crypto/ec/ecp_nistp224.c b/crypto/ec/ecp_nistp224.c index 5afe71c70c..a5e76f41b9 100644 --- a/crypto/ec/ecp_nistp224.c +++ b/crypto/ec/ecp_nistp224.c @@ -1247,8 +1247,7 @@ static void nistp224_pre_comp_clear_free(void *pre_) if (i > 0) return; - OPENSSL_cleanse(pre, sizeof *pre); - OPENSSL_free(pre); + OPENSSL_clear_free(pre, sizeof *pre); } /******************************************************************************/ diff --git a/crypto/ec/ecp_nistp256.c b/crypto/ec/ecp_nistp256.c index 2f394bf88e..6fce22eb61 100644 --- a/crypto/ec/ecp_nistp256.c +++ b/crypto/ec/ecp_nistp256.c @@ -1862,8 +1862,7 @@ static void nistp256_pre_comp_clear_free(void *pre_) if (i > 0) return; - OPENSSL_cleanse(pre, sizeof *pre); - OPENSSL_free(pre); + OPENSSL_clear_free(pre, sizeof *pre); } /******************************************************************************/ diff --git a/crypto/ec/ecp_nistp521.c b/crypto/ec/ecp_nistp521.c index b2fe653f1e..8657a8ff05 100644 --- a/crypto/ec/ecp_nistp521.c +++ b/crypto/ec/ecp_nistp521.c @@ -1691,8 +1691,7 @@ static void nistp521_pre_comp_clear_free(void *pre_) if (i > 0) return; - OPENSSL_cleanse(pre, sizeof(*pre)); - OPENSSL_free(pre); + OPENSSL_clear_free(pre, sizeof(*pre)); } /******************************************************************************/ diff --git a/crypto/ec/ecp_nistz256.c b/crypto/ec/ecp_nistz256.c index c527797341..417c29a682 100644 --- a/crypto/ec/ecp_nistz256.c +++ b/crypto/ec/ecp_nistz256.c @@ -1471,13 +1471,9 @@ static void ecp_nistz256_pre_comp_clear_free(void *pre_) if (i > 0) return; - if (pre->precomp_storage) { - OPENSSL_cleanse(pre->precomp, - 32 * sizeof(unsigned char) * (1 << pre->w) * 2 * 37); - OPENSSL_free(pre->precomp_storage); - } - OPENSSL_cleanse(pre, sizeof *pre); - OPENSSL_free(pre); + OPENSSL_clear_free(pre->precomp, + 32 * sizeof(unsigned char) * (1 << pre->w) * 2 * 37); + OPENSSL_clear_free(pre, sizeof *pre); } static int ecp_nistz256_window_have_precompute_mult(const EC_GROUP *group) diff --git a/crypto/ecdh/ech_lib.c b/crypto/ecdh/ech_lib.c index 7b57ec4ecd..82f8850998 100644 --- a/crypto/ecdh/ech_lib.c +++ b/crypto/ecdh/ech_lib.c @@ -172,10 +172,7 @@ void ecdh_data_free(void *data) #endif CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDH, r, &r->ex_data); - - OPENSSL_cleanse((void *)r, sizeof(ECDH_DATA)); - - OPENSSL_free(r); + OPENSSL_clear_free((void *)r, sizeof(ECDH_DATA)); } ECDH_DATA *ecdh_check(EC_KEY *key) diff --git a/crypto/ecdsa/ecs_lib.c b/crypto/ecdsa/ecs_lib.c index cdb7b6038e..55324f7fef 100644 --- a/crypto/ecdsa/ecs_lib.c +++ b/crypto/ecdsa/ecs_lib.c @@ -160,9 +160,7 @@ static void ecdsa_data_free(void *data) #endif CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDSA, r, &r->ex_data); - OPENSSL_cleanse((void *)r, sizeof(ECDSA_DATA)); - - OPENSSL_free(r); + OPENSSL_clear_free((void *)r, sizeof(ECDSA_DATA)); } ECDSA_DATA *ecdsa_check(EC_KEY *key) diff --git a/crypto/ecdsa/ecs_vrf.c b/crypto/ecdsa/ecs_vrf.c index e909aeb400..b9bd32f619 100644 --- a/crypto/ecdsa/ecs_vrf.c +++ b/crypto/ecdsa/ecs_vrf.c @@ -103,10 +103,7 @@ int ECDSA_verify(int type, const unsigned char *dgst, int dgst_len, goto err; ret = ECDSA_do_verify(dgst, dgst_len, s, eckey); err: - if (derlen > 0) { - OPENSSL_cleanse(der, derlen); - OPENSSL_free(der); - } + OPENSSL_clear_free(der, derlen); ECDSA_SIG_free(s); return (ret); } diff --git a/crypto/engine/eng_openssl.c b/crypto/engine/eng_openssl.c index 78fa3c8d45..cc91044f82 100644 --- a/crypto/engine/eng_openssl.c +++ b/crypto/engine/eng_openssl.c @@ -463,15 +463,10 @@ static int ossl_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) static void ossl_hmac_cleanup(EVP_PKEY_CTX *ctx) { - OSSL_HMAC_PKEY_CTX *hctx; - hctx = EVP_PKEY_CTX_get_data(ctx); + OSSL_HMAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(ctx); + HMAC_CTX_cleanup(&hctx->ctx); - if (hctx->ktmp.data) { - if (hctx->ktmp.length) - OPENSSL_cleanse(hctx->ktmp.data, hctx->ktmp.length); - OPENSSL_free(hctx->ktmp.data); - hctx->ktmp.data = NULL; - } + OPENSSL_clear_free(hctx->ktmp.data, hctx->ktmp.length); OPENSSL_free(hctx); } diff --git a/crypto/evp/bio_enc.c b/crypto/evp/bio_enc.c index 4409a91242..0afd8cc502 100644 --- a/crypto/evp/bio_enc.c +++ b/crypto/evp/bio_enc.c @@ -137,8 +137,7 @@ static int enc_free(BIO *a) return (0); b = (BIO_ENC_CTX *)a->ptr; EVP_CIPHER_CTX_cleanup(&(b->cipher)); - OPENSSL_cleanse(a->ptr, sizeof(BIO_ENC_CTX)); - OPENSSL_free(a->ptr); + OPENSSL_clear_free(a->ptr, sizeof(BIO_ENC_CTX)); a->ptr = NULL; a->init = 0; a->flags = 0; diff --git a/crypto/evp/bio_ok.c b/crypto/evp/bio_ok.c index 1aab2004ef..eced061447 100644 --- a/crypto/evp/bio_ok.c +++ b/crypto/evp/bio_ok.c @@ -202,8 +202,7 @@ static int ok_free(BIO *a) if (a == NULL) return (0); EVP_MD_CTX_cleanup(&((BIO_OK_CTX *)a->ptr)->md); - OPENSSL_cleanse(a->ptr, sizeof(BIO_OK_CTX)); - OPENSSL_free(a->ptr); + OPENSSL_clear_free(a->ptr, sizeof(BIO_OK_CTX)); a->ptr = NULL; a->init = 0; a->flags = 0; diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c index ce95350bfd..043830d5ff 100644 --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -349,8 +349,7 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx) ctx->digest->cleanup(ctx); if (ctx->digest && ctx->digest->ctx_size && ctx->md_data && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) { - OPENSSL_cleanse(ctx->md_data, ctx->digest->ctx_size); - OPENSSL_free(ctx->md_data); + OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size); } EVP_PKEY_CTX_free(ctx->pctx); #ifndef OPENSSL_NO_ENGINE diff --git a/crypto/evp/evp_pbe.c b/crypto/evp/evp_pbe.c index 00fa72d8bb..7a716372c1 100644 --- a/crypto/evp/evp_pbe.c +++ b/crypto/evp/evp_pbe.c @@ -292,7 +292,7 @@ int EVP_PBE_find(int type, int pbe_nid, static void free_evp_pbe_ctl(EVP_PBE_CTL *pbe) { - OPENSSL_freeFunc(pbe); + OPENSSL_free(pbe); } void EVP_PBE_cleanup(void) diff --git a/crypto/evp/p_open.c b/crypto/evp/p_open.c index adaa42fa1e..481c85518a 100644 --- a/crypto/evp/p_open.c +++ b/crypto/evp/p_open.c @@ -105,9 +105,7 @@ int EVP_OpenInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type, ret = 1; err: - if (key != NULL) - OPENSSL_cleanse(key, size); - OPENSSL_free(key); + OPENSSL_clear_free(key, size); return (ret); } diff --git a/crypto/hmac/hm_pmeth.c b/crypto/hmac/hm_pmeth.c index f2be144c8f..f53f78c898 100644 --- a/crypto/hmac/hm_pmeth.c +++ b/crypto/hmac/hm_pmeth.c @@ -113,13 +113,9 @@ static int pkey_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) static void pkey_hmac_cleanup(EVP_PKEY_CTX *ctx) { HMAC_PKEY_CTX *hctx = ctx->data; + HMAC_CTX_cleanup(&hctx->ctx); - if (hctx->ktmp.data) { - if (hctx->ktmp.length) - OPENSSL_cleanse(hctx->ktmp.data, hctx->ktmp.length); - OPENSSL_free(hctx->ktmp.data); - hctx->ktmp.data = NULL; - } + OPENSSL_clear_free(hctx->ktmp.data, hctx->ktmp.length); OPENSSL_free(hctx); } diff --git a/crypto/mem.c b/crypto/mem.c index afdce778dc..6176b38d75 100644 --- a/crypto/mem.c +++ b/crypto/mem.c @@ -417,8 +417,7 @@ void *CRYPTO_realloc_clean(void *str, int old_len, int num, const char *file, ret = malloc_ex_func(num, file, line); if (ret) { memcpy(ret, str, old_len); - OPENSSL_cleanse(str, old_len); - free_func(str); + OPENSSL_clear_free(str, old_len); } #ifdef LEVITTE_DEBUG_MEM fprintf(stderr, @@ -443,6 +442,15 @@ void CRYPTO_free(void *str) free_debug_func(NULL, 1); } +void CRYPTO_clear_free(void *str, size_t num) +{ + if (!str) + return; + if (num) + OPENSSL_cleanse(str, num); + CRYPTO_free(str); +} + void *CRYPTO_remalloc(void *a, int num, const char *file, int line) { if (a != NULL) diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c index 4ac28b32fb..780b326221 100644 --- a/crypto/modes/gcm128.c +++ b/crypto/modes/gcm128.c @@ -1709,10 +1709,7 @@ GCM128_CONTEXT *CRYPTO_gcm128_new(void *key, block128_f block) void CRYPTO_gcm128_release(GCM128_CONTEXT *ctx) { - if (ctx) { - OPENSSL_cleanse(ctx, sizeof(*ctx)); - OPENSSL_free(ctx); - } + OPENSSL_clear_free(ctx, sizeof(*ctx)); } #if defined(SELFTEST) diff --git a/crypto/modes/ocb128.c b/crypto/modes/ocb128.c index 0d82e5089c..efa403b0f1 100644 --- a/crypto/modes/ocb128.c +++ b/crypto/modes/ocb128.c @@ -588,10 +588,7 @@ int CRYPTO_ocb128_tag(OCB128_CONTEXT *ctx, unsigned char *tag, size_t len) void CRYPTO_ocb128_cleanup(OCB128_CONTEXT *ctx) { if (ctx) { - if (ctx->l) { - OPENSSL_cleanse(ctx->l, ctx->max_l_index * 16); - OPENSSL_free(ctx->l); - } + OPENSSL_clear_free(ctx->l, ctx->max_l_index * 16); OPENSSL_cleanse(ctx, sizeof(*ctx)); } } diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index 431e36804f..143d001828 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -429,10 +429,7 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, OPENSSL_cleanse(iv, sizeof(iv)); OPENSSL_cleanse((char *)&ctx, sizeof(ctx)); OPENSSL_cleanse(buf, PEM_BUFSIZE); - if (data != NULL) { - OPENSSL_cleanse(data, (unsigned int)dsize); - OPENSSL_free(data); - } + OPENSSL_clear_free(data, (unsigned int)dsize); return (ret); } @@ -637,8 +634,7 @@ int PEM_write_bio(BIO *bp, const char *name, const char *header, EVP_EncodeFinal(&ctx, buf, &outl); if ((outl > 0) && (BIO_write(bp, (char *)buf, outl) != outl)) goto err; - OPENSSL_cleanse(buf, PEM_BUFSIZE * 8); - OPENSSL_free(buf); + OPENSSL_clear_free(buf, PEM_BUFSIZE * 8); buf = NULL; if ((BIO_write(bp, "-----END ", 9) != 9) || (BIO_write(bp, name, nlen) != nlen) || @@ -646,10 +642,7 @@ int PEM_write_bio(BIO *bp, const char *name, const char *header, goto err; return (i + outl); err: |