diff options
56 files changed, 121 insertions, 311 deletions
diff --git a/apps/apps.c b/apps/apps.c index f74b968baf..aecd6120f9 100644 --- a/apps/apps.c +++ b/apps/apps.c @@ -377,10 +377,7 @@ int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_tmp) } while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0)); - if (buff) { - OPENSSL_cleanse(buff, (unsigned int)bufsiz); - OPENSSL_free(buff); - } + OPENSSL_clear_free(buff, (unsigned int)bufsiz); if (ok >= 0) res = strlen(buf); diff --git a/apps/dgst.c b/apps/dgst.c index 3ff47501bd..69211d34ac 100644 --- a/apps/dgst.c +++ b/apps/dgst.c @@ -441,10 +441,7 @@ int dgst_main(int argc, char **argv) } } end: - if (buf != NULL) { - OPENSSL_cleanse(buf, BUFSIZE); - OPENSSL_free(buf); - } + OPENSSL_clear_free(buf, BUFSIZE); BIO_free(in); if (passin) OPENSSL_free(passin); diff --git a/apps/s_client.c b/apps/s_client.c index 344c88c304..e7e66849d1 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -1994,8 +1994,7 @@ int s_client_main(int argc, char **argv) #endif SSL_CTX_free(ctx); X509_free(cert); - if (crls) - sk_X509_CRL_pop_free(crls, X509_CRL_free); + sk_X509_CRL_pop_free(crls, X509_CRL_free); EVP_PKEY_free(key); sk_X509_pop_free(chain, X509_free); if (pass) @@ -2008,18 +2007,9 @@ int s_client_main(int argc, char **argv) if (jpake_secret && psk_key) OPENSSL_free(psk_key); #endif - if (cbuf != NULL) { - OPENSSL_cleanse(cbuf, BUFSIZZ); - OPENSSL_free(cbuf); - } - if (sbuf != NULL) { - OPENSSL_cleanse(sbuf, BUFSIZZ); - OPENSSL_free(sbuf); - } - if (mbuf != NULL) { - OPENSSL_cleanse(mbuf, BUFSIZZ); - OPENSSL_free(mbuf); - } + OPENSSL_clear_free(cbuf, BUFSIZZ); + OPENSSL_clear_free(sbuf, BUFSIZZ); + OPENSSL_clear_free(mbuf, BUFSIZZ); BIO_free(bio_c_out); bio_c_out = NULL; BIO_free(bio_c_msg); diff --git a/apps/s_server.c b/apps/s_server.c index 21d2d3743e..ef32d5a9b0 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -2395,10 +2395,7 @@ static int sv_body(char *hostname, int s, int stype, unsigned char *context) SSL_free(con); } BIO_printf(bio_s_out, "CONNECTION CLOSED\n"); - if (buf != NULL) { - OPENSSL_cleanse(buf, bufsize); - OPENSSL_free(buf); - } + OPENSSL_clear_free(buf, bufsize); if (ret >= 0) BIO_printf(bio_s_out, "ACCEPT\n"); (void)BIO_flush(bio_s_out); diff --git a/crypto/asn1/a_sign.c b/crypto/asn1/a_sign.c index 21cbe0c347..fb7536d84e 100644 --- a/crypto/asn1/a_sign.c +++ b/crypto/asn1/a_sign.c @@ -203,14 +203,8 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2, signature->flags |= ASN1_STRING_FLAG_BITS_LEFT; err: EVP_MD_CTX_cleanup(&ctx); - if (buf_in != NULL) { - OPENSSL_cleanse((char *)buf_in, (unsigned int)inl); - OPENSSL_free(buf_in); - } - if (buf_out != NULL) { - OPENSSL_cleanse((char *)buf_out, outll); - OPENSSL_free(buf_out); - } + OPENSSL_clear_free((char *)buf_in, (unsigned int)inl); + OPENSSL_clear_free((char *)buf_out, outll); return (outl); } @@ -319,13 +313,7 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, signature->flags |= ASN1_STRING_FLAG_BITS_LEFT; err: EVP_MD_CTX_cleanup(ctx); - if (buf_in != NULL) { - OPENSSL_cleanse((char *)buf_in, (unsigned int)inl); - OPENSSL_free(buf_in); - } - if (buf_out != NULL) { - OPENSSL_cleanse((char *)buf_out, outll); - OPENSSL_free(buf_out); - } + OPENSSL_clear_free((char *)buf_in, (unsigned int)inl); + OPENSSL_clear_free((char *)buf_out, outll); return (outl); } diff --git a/crypto/asn1/a_verify.c b/crypto/asn1/a_verify.c index 6023b148f0..b452999756 100644 --- a/crypto/asn1/a_verify.c +++ b/crypto/asn1/a_verify.c @@ -107,8 +107,7 @@ int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature, ret = EVP_VerifyInit_ex(&ctx, type, NULL) && EVP_VerifyUpdate(&ctx, (unsigned char *)buf_in, inl); - OPENSSL_cleanse(buf_in, (unsigned int)inl); - OPENSSL_free(buf_in); + OPENSSL_clear_free(buf_in, (unsigned int)inl); if (!ret) { ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_EVP_LIB); @@ -208,8 +207,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ret = EVP_DigestVerifyUpdate(&ctx, buf_in, inl); - OPENSSL_cleanse(buf_in, (unsigned int)inl); - OPENSSL_free(buf_in); + OPENSSL_clear_free(buf_in, (unsigned int)inl); if (!ret) { ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB); diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c index 10964646f2..4681154e38 100644 --- a/crypto/bn/bn_rand.c +++ b/crypto/bn/bn_rand.c @@ -187,10 +187,7 @@ static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom) goto err; ret = 1; err: - if (buf != NULL) { - OPENSSL_cleanse(buf, bytes); - OPENSSL_free(buf); - } + OPENSSL_clear_free(buf, bytes); bn_check_top(rnd); return (ret); } diff --git a/crypto/cms/cms_asn1.c b/crypto/cms/cms_asn1.c index 2b61768847..893ad4657b 100644 --- a/crypto/cms/cms_asn1.c +++ b/crypto/cms/cms_asn1.c @@ -251,16 +251,10 @@ static int cms_ri_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, EVP_PKEY_CTX_free(ktri->pctx); } else if (ri->type == CMS_RECIPINFO_KEK) { CMS_KEKRecipientInfo *kekri = ri->d.kekri; - if (kekri->key) { - OPENSSL_cleanse(kekri->key, kekri->keylen); - OPENSSL_free(kekri->key); - } + OPENSSL_clear_free(kekri->key, kekri->keylen); } else if (ri->type == CMS_RECIPINFO_PASS) { CMS_PasswordRecipientInfo *pwri = ri->d.pwri; - if (pwri->pass) { - OPENSSL_cleanse(pwri->pass, pwri->passlen); - OPENSSL_free(pwri->pass); - } + OPENSSL_clear_free(pwri->pass, pwri->passlen); } } return 1; diff --git a/crypto/cms/cms_enc.c b/crypto/cms/cms_enc.c index ffa85fc0dd..f1ac1d535b 100644 --- a/crypto/cms/cms_enc.c +++ b/crypto/cms/cms_enc.c @@ -164,8 +164,7 @@ BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec) goto err; } else { /* Use random key */ - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = tkey; ec->keylen = tkeylen; tkey = NULL; @@ -196,14 +195,10 @@ BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec) err: if (ec->key && !keep_key) { - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = NULL; } - if (tkey) { - OPENSSL_cleanse(tkey, tkeylen); - OPENSSL_free(tkey); - } + OPENSSL_clear_free(tkey, tkeylen); if (ok) return b; BIO_free(b); diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c index 98c1fe0120..d146f845e9 100644 --- a/crypto/cms/cms_env.c +++ b/crypto/cms/cms_env.c @@ -465,11 +465,7 @@ static int cms_RecipientInfo_ktri_decrypt(CMS_ContentInfo *cms, ret = 1; - if (ec->key) { - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); - } - + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = ek; ec->keylen = eklen; @@ -937,12 +933,9 @@ BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms) err: ec->cipher = NULL; - if (ec->key) { - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); - ec->key = NULL; - ec->keylen = 0; - } + OPENSSL_clear_free(ec->key, ec->keylen); + ec->key = NULL; + ec->keylen = 0; if (ok) return ret; BIO_free(ret); diff --git a/crypto/cms/cms_kari.c b/crypto/cms/cms_kari.c index 69a51157e1..17b62ddd8c 100644 --- a/crypto/cms/cms_kari.c +++ b/crypto/cms/cms_kari.c @@ -294,10 +294,7 @@ int CMS_RecipientInfo_kari_decrypt(CMS_ContentInfo *cms, if (!cms_kek_cipher(&cek, &ceklen, enckey, enckeylen, ri->d.kari, 0)) goto err; ec = cms->d.envelopedData->encryptedContentInfo; - if (ec->key) { - OPENSSL_cleanse(ec->key, ec->keylen); - OPENSSL_free(ec->key); - } + OPENSSL_clear_free(ec->key, ec->keylen); ec->key = cek; ec->keylen = ceklen; cek = NULL; diff --git a/crypto/cms/cms_pwri.c b/crypto/cms/cms_pwri.c index ece5ce3640..64165022f3 100644 --- a/crypto/cms/cms_pwri.c +++ b/crypto/cms/cms_pwri.c @@ -263,8 +263,7 @@ static int kek_unwrap_key(unsigned char *out, size_t *outlen, memcpy(out, tmp + 4, *outlen); rv = 1; err: - OPENSSL_cleanse(tmp, inlen); - OPENSSL_free(tmp); + OPENSSL_clear_free(tmp, inlen); return rv; } diff --git a/crypto/dh/dh_pmeth.c b/crypto/dh/dh_pmeth.c index 3fad0548a1..e3ebc0201d 100644 --- a/crypto/dh/dh_pmeth.c +++ b/crypto/dh/dh_pmeth.c @@ -477,10 +477,7 @@ static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, *keylen = dctx->kdf_outlen; ret = 1; err: - if (Z) { - OPENSSL_cleanse(Z, Zlen); - OPENSSL_free(Z); - } + OPENSSL_clear_free(Z, Zlen); return ret; } return 1; diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c index e7f80a8d62..d79f261f2a 100644 --- a/crypto/dsa/dsa_asn1.c +++ b/crypto/dsa/dsa_asn1.c @@ -188,10 +188,7 @@ int DSA_verify(int type, const unsigned char *dgst, int dgst_len, goto err; ret = DSA_do_verify(dgst, dgst_len, s, dsa); err: - if (derlen > 0) { - OPENSSL_cleanse(der, derlen); - OPENSSL_free(der); - } + OPENSSL_clear_free(der, derlen); DSA_SIG_free(s); return (ret); } diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c index b73263d6c1..dbd91d6f69 100644 --- a/crypto/ec/ec_key.c +++ b/crypto/ec/ec_key.c @@ -127,9 +127,7 @@ void EC_KEY_free(EC_KEY *r) EC_EX_DATA_free_all_data(&r->method_data); - OPENSSL_cleanse((void *)r, sizeof(EC_KEY)); - - OPENSSL_free(r); + OPENSSL_clear_free((void *)r, sizeof(EC_KEY)); } EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src) diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c index 0e850d699e..b2a5d79710 100644 --- a/crypto/ec/ec_lib.c +++ b/crypto/ec/ec_lib.c @@ -166,14 +166,8 @@ void EC_GROUP_clear_free(EC_GROUP *group) EC_POINT_clear_free(group->generator); BN_clear_free(group->order); BN_clear_free(group->cofactor); - - if (group->seed) { - OPENSSL_cleanse(group->seed, group->seed_len); - OPENSSL_free(group->seed); - } - - OPENSSL_cleanse(group, sizeof *group); - OPENSSL_free(group); + OPENSSL_clear_free(group->seed, group->seed_len); + OPENSSL_clear_free(group, sizeof *group); } int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src) @@ -751,8 +745,7 @@ void EC_POINT_clear_free(EC_POINT *point) point->meth->point_clear_finish(point); else if (point->meth->point_finish != 0) point->meth->point_finish(point); - OPENSSL_cleanse(point, sizeof *point); - OPENSSL_free(point); + OPENSSL_clear_free(point, sizeof *point); } int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src) diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c index 979b4540ef..6dabfc8d99 100644 --- a/crypto/ec/ec_mult.c +++ b/crypto/ec/ec_mult.c @@ -169,8 +169,7 @@ static void ec_pre_comp_clear_free(void *pre_) } OPENSSL_free(pre->points); } - OPENSSL_cleanse(pre, sizeof *pre); - OPENSSL_free(pre); + OPENSSL_clear_free(pre, sizeof *pre); } /* diff --git a/crypto/ec/ec_pmeth.c b/crypto/ec/ec_pmeth.c index 37f8fa1316..5b3d197b69 100644 --- a/crypto/ec/ec_pmeth.c +++ b/crypto/ec/ec_pmeth.c @@ -268,10 +268,7 @@ static int pkey_ec_kdf_derive(EVP_PKEY_CTX *ctx, rv = 1; err: - if (ktmp) { - OPENSSL_cleanse(ktmp, ktmplen); - OPENSSL_free(ktmp); - } + OPENSSL_clear_free(ktmp, ktmplen); return rv; } #endif diff --git a/crypto/ec/ecp_nistp224.c b/crypto/ec/ecp_nistp224.c index 5afe71c70c..a5e76f41b9 100644 --- a/crypto/ec/ecp_nistp224.c +++ b/crypto/ec/ecp_nistp224.c @@ -1247,8 +1247,7 @@ static void nistp224_pre_comp_clear_free(void *pre_) if (i > 0) return; - OPENSSL_cleanse(pre, sizeof *pre); - OPENSSL_free(pre); + OPENSSL_clear_free(pre, sizeof *pre); } /******************************************************************************/ diff --git a/crypto/ec/ecp_nistp256.c b/crypto/ec/ecp_nistp256.c index 2f394bf88e..6fce22eb61 100644 --- a/crypto/ec/ecp_nistp256.c +++ b/crypto/ec/ecp_nistp256.c @@ -1862,8 +1862,7 @@ static void nistp256_pre_comp_clear_free(void *pre_) if (i > 0) return; - OPENSSL_cleanse(pre, sizeof *pre); - OPENSSL_free(pre); + OPENSSL_clear_free(pre, sizeof *pre); } /******************************************************************************/ diff --git a/crypto/ec/ecp_nistp521.c b/crypto/ec/ecp_nistp521.c index b2fe653f1e..8657a8ff05 100644 --- a/crypto/ec/ecp_nistp521.c +++ b/crypto/ec/ecp_nistp521.c @@ -1691,8 +1691,7 @@ static void nistp521_pre_comp_clear_free(void *pre_) if (i > 0) return; - OPENSSL_cleanse(pre, sizeof(*pre)); - OPENSSL_free(pre); + OPENSSL_clear_free(pre, sizeof(*pre)); } /******************************************************************************/ diff --git a/crypto/ec/ecp_nistz256.c b/crypto/ec/ecp_nistz256.c index c527797341..417c29a682 100644 --- a/crypto/ec/ecp_nistz256.c +++ b/crypto/ec/ecp_nistz256.c @@ -1471,13 +1471,9 @@ static void ecp_nistz256_pre_comp_clear_free(void *pre_) if (i > 0) return; - if (pre->precomp_storage) { - OPENSSL_cleanse(pre->precomp, - 32 * sizeof(unsigned char) * (1 << pre->w) * 2 * 37); - OPENSSL_free(pre->precomp_storage); - } - OPENSSL_cleanse(pre, sizeof *pre); - OPENSSL_free(pre); + OPENSSL_clear_free(pre->precomp, + 32 * sizeof(unsigned char) * (1 << pre->w) * 2 * 37); + OPENSSL_clear_free(pre, sizeof *pre); } static int ecp_nistz256_window_have_precompute_mult(const EC_GROUP *group) diff --git a/crypto/ecdh/ech_lib.c b/crypto/ecdh/ech_lib.c index 7b57ec4ecd..82f8850998 100644 --- a/crypto/ecdh/ech_lib.c +++ b/crypto/ecdh/ech_lib.c @@ -172,10 +172,7 @@ void ecdh_data_free(void *data) #endif CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDH, r, &r->ex_data); - - OPENSSL_cleanse((void *)r, sizeof(ECDH_DATA)); - - OPENSSL_free(r); + OPENSSL_clear_free((void *)r, sizeof(ECDH_DATA)); } ECDH_DATA *ecdh_check(EC_KEY *key) diff --git a/crypto/ecdsa/ecs_lib.c b/crypto/ecdsa/ecs_lib.c index cdb7b6038e..55324f7fef 100644 --- a/crypto/ecdsa/ecs_lib.c +++ b/crypto/ecdsa/ecs_lib.c @@ -160,9 +160,7 @@ static void ecdsa_data_free(void *data) #endif CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDSA, r, &r->ex_data); - OPENSSL_cleanse((void *)r, sizeof(ECDSA_DATA)); - - OPENSSL_free(r); + OPENSSL_clear_free((void *)r, sizeof(ECDSA_DATA)); } ECDSA_DATA *ecdsa_check(EC_KEY *key) diff --git a/crypto/ecdsa/ecs_vrf.c b/crypto/ecdsa/ecs_vrf.c index e909aeb400..b9bd32f619 100644 --- a/crypto/ecdsa/ecs_vrf.c +++ b/crypto/ecdsa/ecs_vrf.c @@ -103,10 +103,7 @@ int ECDSA_verify(int type, const unsigned char *dgst, int dgst_len, goto err; ret = ECDSA_do_verify(dgst, dgst_len, s, eckey); err: - if (derlen > 0) { - OPENSSL_cleanse(der, derlen); - OPENSSL_free(der); - } + OPENSSL_clear_free(der, derlen); ECDSA_SIG_free(s); return (ret); } diff --git a/crypto/engine/eng_openssl.c b/crypto/engine/eng_openssl.c index 78fa3c8d45..cc91044f82 100644 --- a/crypto/engine/eng_openssl.c +++ b/crypto/engine/eng_openssl.c @@ -463,15 +463,10 @@ static int ossl_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) static void ossl_hmac_cleanup(EVP_PKEY_CTX *ctx) { - OSSL_HMAC_PKEY_CTX *hctx; - hctx = EVP_PKEY_CTX_get_data(ctx); + OSSL_HMAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(ctx); + HMAC_CTX_cleanup(&hctx->ctx); - if (hctx->ktmp.data) { - if (hctx->ktmp.length) - OPENSSL_cleanse(hctx->ktmp.data, hctx->ktmp.length); - OPENSSL_free(hctx->ktmp.data); - hctx->ktmp.data = NULL; - } + OPENSSL_clear_free(hctx->ktmp.data, hctx->ktmp.length); OPENSSL_free(hctx); } diff --git a/crypto/evp/bio_enc.c b/crypto/evp/bio_enc.c index 4409a91242..0afd8cc502 100644 --- a/crypto/evp/bio_enc.c +++ b/crypto/evp/bio_enc.c @@ -137,8 +137,7 @@ static int enc_free(BIO *a) return (0); b = (BIO_ENC_CTX *)a->ptr; EVP_CIPHER_CTX_cleanup(&(b->cipher)); - OPENSSL_cleanse(a->ptr, sizeof(BIO_ENC_CTX)); - OPENSSL_free(a->ptr); + OPENSSL_clear_free(a->ptr, sizeof(BIO_ENC_CTX)); a->ptr = NULL; a->init = 0; a->flags = 0; diff --git a/crypto/evp/bio_ok.c b/crypto/evp/bio_ok.c index 1aab2004ef..eced061447 100644 --- a/crypto/evp/bio_ok.c +++ b/crypto/evp/bio_ok.c @@ -202,8 +202,7 @@ static int ok_free(BIO *a) if (a == NULL) return (0); EVP_MD_CTX_cleanup(&((BIO_OK_CTX *)a->ptr)->md); - OPENSSL_cleanse(a->ptr, sizeof(BIO_OK_CTX)); - OPENSSL_free(a->ptr); + OPENSSL_clear_free(a->ptr, sizeof(BIO_OK_CTX)); a->ptr = NULL; a->init = 0; a->flags = 0; diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c index ce95350bfd..043830d5ff 100644 --- a/crypto/evp/digest.c +++ b/crypto/evp/digest.c @@ -349,8 +349,7 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx) ctx->digest->cleanup(ctx); if (ctx->digest && ctx->digest->ctx_size && ctx->md_data && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) { - OPENSSL_cleanse(ctx->md_data, ctx->digest->ctx_size); - OPENSSL_free(ctx->md_data); + OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size); } EVP_PKEY_CTX_free(ctx->pctx); #ifndef OPENSSL_NO_ENGINE diff --git a/crypto/evp/evp_pbe.c b/crypto/evp/evp_pbe.c index 00fa72d8bb..7a71 |