diff options
| author | Shane Lontis <shane.lontis@oracle.com> | 2018-09-04 14:31:11 +1000 |
|---|---|---|
| committer | Pauli <paul.dale@oracle.com> | 2018-09-05 05:15:04 +1000 |
| commit | b4b651b09e738e8874c59f9fd24ec52d7258e5b4 (patch) | |
| tree | 552762ae56731a8ae735577f29c263c6ffe81517 /crypto | |
| parent | 1018ba701368bdcdec7190bfcd2fb4076d0c1244 (diff) | |
key zeroisation for pvkfmt now done on all branch paths
Reviewed-by: Paul Yang <yang.yang@baishancloud.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7107)
(cherry picked from commit 0239283d99a37e8527199a62100fec867b9996cb)
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/pem/pvkfmt.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/crypto/pem/pvkfmt.c b/crypto/pem/pvkfmt.c index 63ce925963..96a82eb520 100644 --- a/crypto/pem/pvkfmt.c +++ b/crypto/pem/pvkfmt.c @@ -675,11 +675,11 @@ static EVP_PKEY *do_PVK_body(const unsigned char **in, const unsigned char *p = *in; unsigned int magic; unsigned char *enctmp = NULL, *q; + unsigned char keybuf[20]; EVP_CIPHER_CTX *cctx = EVP_CIPHER_CTX_new(); if (saltlen) { char psbuf[PEM_BUFSIZE]; - unsigned char keybuf[20]; int enctmplen, inlen; if (cb) inlen = cb(psbuf, PEM_BUFSIZE, 0, u); @@ -719,7 +719,6 @@ static EVP_PKEY *do_PVK_body(const unsigned char **in, memset(keybuf + 5, 0, 11); if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL)) goto err; - OPENSSL_cleanse(keybuf, 20); if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen)) goto err; if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen)) @@ -729,15 +728,17 @@ static EVP_PKEY *do_PVK_body(const unsigned char **in, PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_DECRYPT); goto err; } - } else - OPENSSL_cleanse(keybuf, 20); + } p = enctmp; } ret = b2i_PrivateKey(&p, keylen); err: EVP_CIPHER_CTX_free(cctx); - OPENSSL_free(enctmp); + if (enctmp != NULL) { + OPENSSL_cleanse(keybuf, sizeof(keybuf)); + OPENSSL_free(enctmp); + } return ret; } |