free cleanup almost the finale

Add OPENSSL_clear_free which merges cleanse and free.
(Names was picked to be similar to BN_clear_free, etc.)
Removed OPENSSL_freeFunc macro.
Fixed the small simple ones that are left:
        CRYPTO_free CRYPTO_free_locked OPENSSL_free_locked

Reviewed-by: Richard Levitte <levitte@openssl.org>

diff --git a/apps/apps.c b/apps/apps.c
index f74b968baf98c7868b35842b215ae7146bde002c..aecd6120f9683df82f575aecdc732a32eb685606 100644 (file)
--- a/apps/apps.c
+++ b/apps/apps.c
@@ -377,10 +377,7 @@ int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_tmp)
             }
             while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));
 
-        if (buff) {
-            OPENSSL_cleanse(buff, (unsigned int)bufsiz);
-            OPENSSL_free(buff);
-        }
+        OPENSSL_clear_free(buff, (unsigned int)bufsiz);
 
         if (ok >= 0)
             res = strlen(buf);

diff --git a/apps/dgst.c b/apps/dgst.c
index 3ff47501bd9063850dde085188568e6ab4924588..69211d34aca1bf16e9075d7c49eef699bd2c6145 100644 (file)
--- a/apps/dgst.c
+++ b/apps/dgst.c
@@ -441,10 +441,7 @@ int dgst_main(int argc, char **argv)
         }
     }
  end:
-    if (buf != NULL) {
-        OPENSSL_cleanse(buf, BUFSIZE);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, BUFSIZE);
     BIO_free(in);
     if (passin)
         OPENSSL_free(passin);

diff --git a/apps/s_client.c b/apps/s_client.c
index 344c88c304799f775a74a3f81f7fcc53ae357acb..e7e66849d169dc4fd80000e228e894fff08b2456 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -1994,8 +1994,7 @@ int s_client_main(int argc, char **argv)
 #endif
     SSL_CTX_free(ctx);
     X509_free(cert);
-    if (crls)
-        sk_X509_CRL_pop_free(crls, X509_CRL_free);
+    sk_X509_CRL_pop_free(crls, X509_CRL_free);
     EVP_PKEY_free(key);
     sk_X509_pop_free(chain, X509_free);
     if (pass)
@@ -2008,18 +2007,9 @@ int s_client_main(int argc, char **argv)
     if (jpake_secret && psk_key)
         OPENSSL_free(psk_key);
 #endif
-    if (cbuf != NULL) {
-        OPENSSL_cleanse(cbuf, BUFSIZZ);
-        OPENSSL_free(cbuf);
-    }
-    if (sbuf != NULL) {
-        OPENSSL_cleanse(sbuf, BUFSIZZ);
-        OPENSSL_free(sbuf);
-    }
-    if (mbuf != NULL) {
-        OPENSSL_cleanse(mbuf, BUFSIZZ);
-        OPENSSL_free(mbuf);
-    }
+    OPENSSL_clear_free(cbuf, BUFSIZZ);
+    OPENSSL_clear_free(sbuf, BUFSIZZ);
+    OPENSSL_clear_free(mbuf, BUFSIZZ);
     BIO_free(bio_c_out);
     bio_c_out = NULL;
     BIO_free(bio_c_msg);

diff --git a/apps/s_server.c b/apps/s_server.c
index 21d2d3743e3fa071bb247c91aa0191e477587c8a..ef32d5a9b0758f7fa9c9f054f91e69b599a2f7ab 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -2395,10 +2395,7 @@ static int sv_body(char *hostname, int s, int stype, unsigned char *context)
         SSL_free(con);
     }
     BIO_printf(bio_s_out, "CONNECTION CLOSED\n");
-    if (buf != NULL) {
-        OPENSSL_cleanse(buf, bufsize);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, bufsize);
     if (ret >= 0)
         BIO_printf(bio_s_out, "ACCEPT\n");
     (void)BIO_flush(bio_s_out);

diff --git a/crypto/asn1/a_sign.c b/crypto/asn1/a_sign.c
index 21cbe0c347ba36f9f8d3fce4ce9ec3975c95def6..fb7536d84ef141f73686dc32f845a8ee0905147f 100644 (file)
--- a/crypto/asn1/a_sign.c
+++ b/crypto/asn1/a_sign.c
@@ -203,14 +203,8 @@ int ASN1_sign(i2d_of_void *i2d, X509_ALGOR *algor1, X509_ALGOR *algor2,
     signature->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  err:
     EVP_MD_CTX_cleanup(&ctx);
-    if (buf_in != NULL) {
-        OPENSSL_cleanse((char *)buf_in, (unsigned int)inl);
-        OPENSSL_free(buf_in);
-    }
-    if (buf_out != NULL) {
-        OPENSSL_cleanse((char *)buf_out, outll);
-        OPENSSL_free(buf_out);
-    }
+    OPENSSL_clear_free((char *)buf_in, (unsigned int)inl);
+    OPENSSL_clear_free((char *)buf_out, outll);
     return (outl);
 }
 
@@ -319,13 +313,7 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it,
     signature->flags |= ASN1_STRING_FLAG_BITS_LEFT;
  err:
     EVP_MD_CTX_cleanup(ctx);
-    if (buf_in != NULL) {
-        OPENSSL_cleanse((char *)buf_in, (unsigned int)inl);
-        OPENSSL_free(buf_in);
-    }
-    if (buf_out != NULL) {
-        OPENSSL_cleanse((char *)buf_out, outll);
-        OPENSSL_free(buf_out);
-    }
+    OPENSSL_clear_free((char *)buf_in, (unsigned int)inl);
+    OPENSSL_clear_free((char *)buf_out, outll);
     return (outl);
 }

diff --git a/crypto/asn1/a_verify.c b/crypto/asn1/a_verify.c
index 6023b148f06427b18ff02891b91263b363131ed7..b452999756bd96cc47b095d53120e2d5ddccef58 100644 (file)
--- a/crypto/asn1/a_verify.c
+++ b/crypto/asn1/a_verify.c
@@ -107,8 +107,7 @@ int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature,
     ret = EVP_VerifyInit_ex(&ctx, type, NULL)
         && EVP_VerifyUpdate(&ctx, (unsigned char *)buf_in, inl);
 
-    OPENSSL_cleanse(buf_in, (unsigned int)inl);
-    OPENSSL_free(buf_in);
+    OPENSSL_clear_free(buf_in, (unsigned int)inl);
 
     if (!ret) {
         ASN1err(ASN1_F_ASN1_VERIFY, ERR_R_EVP_LIB);
@@ -208,8 +207,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a,
 
     ret = EVP_DigestVerifyUpdate(&ctx, buf_in, inl);
 
-    OPENSSL_cleanse(buf_in, (unsigned int)inl);
-    OPENSSL_free(buf_in);
+    OPENSSL_clear_free(buf_in, (unsigned int)inl);
 
     if (!ret) {
         ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB);

diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c
index 10964646f27ff9b1b830bffa071204d23bc3dc34..4681154e3894e6cc74728d07b1bf51284ad3e98e 100644 (file)
--- a/crypto/bn/bn_rand.c
+++ b/crypto/bn/bn_rand.c
@@ -187,10 +187,7 @@ static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
         goto err;
     ret = 1;
  err:
-    if (buf != NULL) {
-        OPENSSL_cleanse(buf, bytes);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, bytes);
     bn_check_top(rnd);
     return (ret);
 }

diff --git a/crypto/cms/cms_asn1.c b/crypto/cms/cms_asn1.c
index 2b61768847e08b3656781795aebc5d58af9d2674..893ad4657bba688ca6196f8b2fd8d95236840a50 100644 (file)
--- a/crypto/cms/cms_asn1.c
+++ b/crypto/cms/cms_asn1.c
@@ -251,16 +251,10 @@ static int cms_ri_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
             EVP_PKEY_CTX_free(ktri->pctx);
         } else if (ri->type == CMS_RECIPINFO_KEK) {
             CMS_KEKRecipientInfo *kekri = ri->d.kekri;
-            if (kekri->key) {
-                OPENSSL_cleanse(kekri->key, kekri->keylen);
-                OPENSSL_free(kekri->key);
-            }
+            OPENSSL_clear_free(kekri->key, kekri->keylen);
         } else if (ri->type == CMS_RECIPINFO_PASS) {
             CMS_PasswordRecipientInfo *pwri = ri->d.pwri;
-            if (pwri->pass) {
-                OPENSSL_cleanse(pwri->pass, pwri->passlen);
-                OPENSSL_free(pwri->pass);
-            }
+            OPENSSL_clear_free(pwri->pass, pwri->passlen);
         }
     }
     return 1;

diff --git a/crypto/cms/cms_enc.c b/crypto/cms/cms_enc.c
index ffa85fc0dd9e59bbde115203de866832867b7539..f1ac1d535b831db636204ac3d60279aa61f6d49f 100644 (file)
--- a/crypto/cms/cms_enc.c
+++ b/crypto/cms/cms_enc.c
@@ -164,8 +164,7 @@ BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec)
                 goto err;
             } else {
                 /* Use random key */
-                OPENSSL_cleanse(ec->key, ec->keylen);
-                OPENSSL_free(ec->key);
+                OPENSSL_clear_free(ec->key, ec->keylen);
                 ec->key = tkey;
                 ec->keylen = tkeylen;
                 tkey = NULL;
@@ -196,14 +195,10 @@ BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec)
 
  err:
     if (ec->key && !keep_key) {
-        OPENSSL_cleanse(ec->key, ec->keylen);
-        OPENSSL_free(ec->key);
+        OPENSSL_clear_free(ec->key, ec->keylen);
         ec->key = NULL;
     }
-    if (tkey) {
-        OPENSSL_cleanse(tkey, tkeylen);
-        OPENSSL_free(tkey);
-    }
+    OPENSSL_clear_free(tkey, tkeylen);
     if (ok)
         return b;
     BIO_free(b);

diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c
index 98c1fe012022ac878d93b2cb5c3ed63b35fb46bb..d146f845e9042ab1c1aea46e5143760069891192 100644 (file)
--- a/crypto/cms/cms_env.c
+++ b/crypto/cms/cms_env.c
@@ -465,11 +465,7 @@ static int cms_RecipientInfo_ktri_decrypt(CMS_ContentInfo *cms,
 
     ret = 1;
 
-    if (ec->key) {
-        OPENSSL_cleanse(ec->key, ec->keylen);
-        OPENSSL_free(ec->key);
-    }
-
+    OPENSSL_clear_free(ec->key, ec->keylen);
     ec->key = ek;
     ec->keylen = eklen;
 
@@ -937,12 +933,9 @@ BIO *cms_EnvelopedData_init_bio(CMS_ContentInfo *cms)
 
  err:
     ec->cipher = NULL;
-    if (ec->key) {
-        OPENSSL_cleanse(ec->key, ec->keylen);
-        OPENSSL_free(ec->key);
-        ec->key = NULL;
-        ec->keylen = 0;
-    }
+    OPENSSL_clear_free(ec->key, ec->keylen);
+    ec->key = NULL;
+    ec->keylen = 0;
     if (ok)
         return ret;
     BIO_free(ret);

diff --git a/crypto/cms/cms_kari.c b/crypto/cms/cms_kari.c
index 69a51157e1b1cc8a8bce5a39dc645b05ab8a565a..17b62ddd8cd0bfd16ad03bcf364175c6b20c3e46 100644 (file)
--- a/crypto/cms/cms_kari.c
+++ b/crypto/cms/cms_kari.c
@@ -294,10 +294,7 @@ int CMS_RecipientInfo_kari_decrypt(CMS_ContentInfo *cms,
     if (!cms_kek_cipher(&cek, &ceklen, enckey, enckeylen, ri->d.kari, 0))
         goto err;
     ec = cms->d.envelopedData->encryptedContentInfo;
-    if (ec->key) {
-        OPENSSL_cleanse(ec->key, ec->keylen);
-        OPENSSL_free(ec->key);
-    }
+    OPENSSL_clear_free(ec->key, ec->keylen);
     ec->key = cek;
     ec->keylen = ceklen;
     cek = NULL;

diff --git a/crypto/cms/cms_pwri.c b/crypto/cms/cms_pwri.c
index ece5ce36406871479070c58bc7e7b6bd89d75714..64165022f3bc0b6e57e0ce6ac9eec529b7cbbeee 100644 (file)
--- a/crypto/cms/cms_pwri.c
+++ b/crypto/cms/cms_pwri.c
@@ -263,8 +263,7 @@ static int kek_unwrap_key(unsigned char *out, size_t *outlen,
     memcpy(out, tmp + 4, *outlen);
     rv = 1;
  err:
-    OPENSSL_cleanse(tmp, inlen);
-    OPENSSL_free(tmp);
+    OPENSSL_clear_free(tmp, inlen);
     return rv;
 
 }

diff --git a/crypto/dh/dh_pmeth.c b/crypto/dh/dh_pmeth.c
index 3fad0548a13e88488fc4973f6c037776689fb205..e3ebc0201d8670c7a1f904069dbed230d175e8c6 100644 (file)
--- a/crypto/dh/dh_pmeth.c
+++ b/crypto/dh/dh_pmeth.c
@@ -477,10 +477,7 @@ static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
         *keylen = dctx->kdf_outlen;
         ret = 1;
  err:
-        if (Z) {
-            OPENSSL_cleanse(Z, Zlen);
-            OPENSSL_free(Z);
-        }
+        OPENSSL_clear_free(Z, Zlen);
         return ret;
     }
     return 1;

diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c
index e7f80a8d6285f250798bc16269f434bd01c8f44f..d79f261f2ac7980e773c6e345b54e8b164b2a542 100644 (file)
--- a/crypto/dsa/dsa_asn1.c
+++ b/crypto/dsa/dsa_asn1.c
@@ -188,10 +188,7 @@ int DSA_verify(int type, const unsigned char *dgst, int dgst_len,
         goto err;
     ret = DSA_do_verify(dgst, dgst_len, s, dsa);
  err:
-    if (derlen > 0) {
-        OPENSSL_cleanse(der, derlen);
-        OPENSSL_free(der);
-    }
+    OPENSSL_clear_free(der, derlen);
     DSA_SIG_free(s);
     return (ret);
 }

diff --git a/crypto/ec/ec_key.c b/crypto/ec/ec_key.c
index b73263d6c1cb01d559f222d3bbd091b2dc868784..dbd91d6f698ad7a5b5c9c5953d315e51c28a1946 100644 (file)
--- a/crypto/ec/ec_key.c
+++ b/crypto/ec/ec_key.c
@@ -127,9 +127,7 @@ void EC_KEY_free(EC_KEY *r)
 
     EC_EX_DATA_free_all_data(&r->method_data);
 
-    OPENSSL_cleanse((void *)r, sizeof(EC_KEY));
-
-    OPENSSL_free(r);
+    OPENSSL_clear_free((void *)r, sizeof(EC_KEY));
 }
 
 EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)

diff --git a/crypto/ec/ec_lib.c b/crypto/ec/ec_lib.c
index 0e850d699ebb7596ee0a700138485fdf82a797ca..b2a5d79710222cf1f40161adad08b0a8ab8ac375 100644 (file)
--- a/crypto/ec/ec_lib.c
+++ b/crypto/ec/ec_lib.c
@@ -166,14 +166,8 @@ void EC_GROUP_clear_free(EC_GROUP *group)
     EC_POINT_clear_free(group->generator);
     BN_clear_free(group->order);
     BN_clear_free(group->cofactor);
-
-    if (group->seed) {
-        OPENSSL_cleanse(group->seed, group->seed_len);
-        OPENSSL_free(group->seed);
-    }
-
-    OPENSSL_cleanse(group, sizeof *group);
-    OPENSSL_free(group);
+    OPENSSL_clear_free(group->seed, group->seed_len);
+    OPENSSL_clear_free(group, sizeof *group);
 }
 
 int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
@@ -751,8 +745,7 @@ void EC_POINT_clear_free(EC_POINT *point)
         point->meth->point_clear_finish(point);
     else if (point->meth->point_finish != 0)
         point->meth->point_finish(point);
-    OPENSSL_cleanse(point, sizeof *point);
-    OPENSSL_free(point);
+    OPENSSL_clear_free(point, sizeof *point);
 }
 
 int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src)

diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c
index 979b4540ef34e9f3d60eede324852940d5bef640..6dabfc8d9966c9f7cbc906a897affd917ad76526 100644 (file)
--- a/crypto/ec/ec_mult.c
+++ b/crypto/ec/ec_mult.c
@@ -169,8 +169,7 @@ static void ec_pre_comp_clear_free(void *pre_)
         }
         OPENSSL_free(pre->points);
     }
-    OPENSSL_cleanse(pre, sizeof *pre);
-    OPENSSL_free(pre);
+    OPENSSL_clear_free(pre, sizeof *pre);
 }
 
 /*

diff --git a/crypto/ec/ec_pmeth.c b/crypto/ec/ec_pmeth.c
index 37f8fa13168f4a1542c075d5927a6ad35e45168a..5b3d197b69c0f79ee8541e681dccbefd55beb81e 100644 (file)
--- a/crypto/ec/ec_pmeth.c
+++ b/crypto/ec/ec_pmeth.c
@@ -268,10 +268,7 @@ static int pkey_ec_kdf_derive(EVP_PKEY_CTX *ctx,
     rv = 1;
 
  err:
-    if (ktmp) {
-        OPENSSL_cleanse(ktmp, ktmplen);
-        OPENSSL_free(ktmp);
-    }
+    OPENSSL_clear_free(ktmp, ktmplen);
     return rv;
 }
 #endif

diff --git a/crypto/ec/ecp_nistp224.c b/crypto/ec/ecp_nistp224.c
index 5afe71c70c48597be74dd0016e8ba402798887fa..a5e76f41b9f71de6cbee6f7907f67e3bef8a509a 100644 (file)
--- a/crypto/ec/ecp_nistp224.c
+++ b/crypto/ec/ecp_nistp224.c
@@ -1247,8 +1247,7 @@ static void nistp224_pre_comp_clear_free(void *pre_)
     if (i > 0)
         return;
 
-    OPENSSL_cleanse(pre, sizeof *pre);
-    OPENSSL_free(pre);
+    OPENSSL_clear_free(pre, sizeof *pre);
 }
 
 /******************************************************************************/

diff --git a/crypto/ec/ecp_nistp256.c b/crypto/ec/ecp_nistp256.c
index 2f394bf88e6b2be005ecfca410cdef71146ecc49..6fce22eb61613e5c6944676371ab3af2fd82b8d5 100644 (file)
--- a/crypto/ec/ecp_nistp256.c
+++ b/crypto/ec/ecp_nistp256.c
@@ -1862,8 +1862,7 @@ static void nistp256_pre_comp_clear_free(void *pre_)
     if (i > 0)
         return;
 
-    OPENSSL_cleanse(pre, sizeof *pre);
-    OPENSSL_free(pre);
+    OPENSSL_clear_free(pre, sizeof *pre);
 }
 
 /******************************************************************************/

diff --git a/crypto/ec/ecp_nistp521.c b/crypto/ec/ecp_nistp521.c
index b2fe653f1e52660a501d1c1bebbdcf8d84efebdf..8657a8ff05842d12f49210094e54da626425e134 100644 (file)
--- a/crypto/ec/ecp_nistp521.c
+++ b/crypto/ec/ecp_nistp521.c
@@ -1691,8 +1691,7 @@ static void nistp521_pre_comp_clear_free(void *pre_)
     if (i > 0)
         return;
 
-    OPENSSL_cleanse(pre, sizeof(*pre));
-    OPENSSL_free(pre);
+    OPENSSL_clear_free(pre, sizeof(*pre));
 }
 
 /******************************************************************************/

diff --git a/crypto/ec/ecp_nistz256.c b/crypto/ec/ecp_nistz256.c
index c5277973418c475e2fa60dafdffbe06c7e4efe25..417c29a682968db2a2ac11c7e25253cc48daca6b 100644 (file)
--- a/crypto/ec/ecp_nistz256.c
+++ b/crypto/ec/ecp_nistz256.c
@@ -1471,13 +1471,9 @@ static void ecp_nistz256_pre_comp_clear_free(void *pre_)
     if (i > 0)
         return;
 
-    if (pre->precomp_storage) {
-        OPENSSL_cleanse(pre->precomp,
-                        32 * sizeof(unsigned char) * (1 << pre->w) * 2 * 37);
-        OPENSSL_free(pre->precomp_storage);
-    }
-    OPENSSL_cleanse(pre, sizeof *pre);
-    OPENSSL_free(pre);
+    OPENSSL_clear_free(pre->precomp,
+                       32 * sizeof(unsigned char) * (1 << pre->w) * 2 * 37);
+    OPENSSL_clear_free(pre, sizeof *pre);
 }
 
 static int ecp_nistz256_window_have_precompute_mult(const EC_GROUP *group)

diff --git a/crypto/ecdh/ech_lib.c b/crypto/ecdh/ech_lib.c
index 7b57ec4ecdc5b9fd210780d59cb70302e247cad9..82f885099876bd26f671e380486c110e5c728a86 100644 (file)
--- a/crypto/ecdh/ech_lib.c
+++ b/crypto/ecdh/ech_lib.c
@@ -172,10 +172,7 @@ void ecdh_data_free(void *data)
 #endif
 
     CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDH, r, &r->ex_data);
-
-    OPENSSL_cleanse((void *)r, sizeof(ECDH_DATA));
-
-    OPENSSL_free(r);
+    OPENSSL_clear_free((void *)r, sizeof(ECDH_DATA));
 }
 
 ECDH_DATA *ecdh_check(EC_KEY *key)

diff --git a/crypto/ecdsa/ecs_lib.c b/crypto/ecdsa/ecs_lib.c
index cdb7b6038e5c9fe08cab5369c00750e3a3c26b35..55324f7fef6652c82e4a6a67eece6e55365c2b32 100644 (file)
--- a/crypto/ecdsa/ecs_lib.c
+++ b/crypto/ecdsa/ecs_lib.c
@@ -160,9 +160,7 @@ static void ecdsa_data_free(void *data)
 #endif
     CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDSA, r, &r->ex_data);
 
-    OPENSSL_cleanse((void *)r, sizeof(ECDSA_DATA));
-
-    OPENSSL_free(r);
+    OPENSSL_clear_free((void *)r, sizeof(ECDSA_DATA));
 }
 
 ECDSA_DATA *ecdsa_check(EC_KEY *key)

diff --git a/crypto/ecdsa/ecs_vrf.c b/crypto/ecdsa/ecs_vrf.c
index e909aeb400a444fad7e2993fd177c4d60e82e437..b9bd32f619866e569e4779a7d550ea527511d41b 100644 (file)
--- a/crypto/ecdsa/ecs_vrf.c
+++ b/crypto/ecdsa/ecs_vrf.c
@@ -103,10 +103,7 @@ int ECDSA_verify(int type, const unsigned char *dgst, int dgst_len,
         goto err;
     ret = ECDSA_do_verify(dgst, dgst_len, s, eckey);
  err:
-    if (derlen > 0) {
-        OPENSSL_cleanse(der, derlen);
-        OPENSSL_free(der);
-    }
+    OPENSSL_clear_free(der, derlen);
     ECDSA_SIG_free(s);
     return (ret);
 }

diff --git a/crypto/engine/eng_openssl.c b/crypto/engine/eng_openssl.c
index 78fa3c8d455af26d0ace59db7876b3b2e17609e6..cc91044f821b5340e17e8d9f6ba26f8fc6366034 100644 (file)
--- a/crypto/engine/eng_openssl.c
+++ b/crypto/engine/eng_openssl.c
@@ -463,15 +463,10 @@ static int ossl_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
 
 static void ossl_hmac_cleanup(EVP_PKEY_CTX *ctx)
 {
-    OSSL_HMAC_PKEY_CTX *hctx;
-    hctx = EVP_PKEY_CTX_get_data(ctx);
+    OSSL_HMAC_PKEY_CTX *hctx = EVP_PKEY_CTX_get_data(ctx);
+
     HMAC_CTX_cleanup(&hctx->ctx);
-    if (hctx->ktmp.data) {
-        if (hctx->ktmp.length)
-            OPENSSL_cleanse(hctx->ktmp.data, hctx->ktmp.length);
-        OPENSSL_free(hctx->ktmp.data);
-        hctx->ktmp.data = NULL;
-    }
+    OPENSSL_clear_free(hctx->ktmp.data, hctx->ktmp.length);
     OPENSSL_free(hctx);
 }
 

diff --git a/crypto/evp/bio_enc.c b/crypto/evp/bio_enc.c
index 4409a91242b473eefd8b27e49d18c06d79cb7049..0afd8cc502dc5a641eeef32251d6c3f704f7cb05 100644 (file)
--- a/crypto/evp/bio_enc.c
+++ b/crypto/evp/bio_enc.c
@@ -137,8 +137,7 @@ static int enc_free(BIO *a)
         return (0);
     b = (BIO_ENC_CTX *)a->ptr;
     EVP_CIPHER_CTX_cleanup(&(b->cipher));
-    OPENSSL_cleanse(a->ptr, sizeof(BIO_ENC_CTX));
-    OPENSSL_free(a->ptr);
+    OPENSSL_clear_free(a->ptr, sizeof(BIO_ENC_CTX));
     a->ptr = NULL;
     a->init = 0;
     a->flags = 0;

diff --git a/crypto/evp/bio_ok.c b/crypto/evp/bio_ok.c
index 1aab2004ef1315f7cb1bc67a0cda411c6210e642..eced061447c428e732511f25a05e2be49d89a69d 100644 (file)
--- a/crypto/evp/bio_ok.c
+++ b/crypto/evp/bio_ok.c
@@ -202,8 +202,7 @@ static int ok_free(BIO *a)
     if (a == NULL)
         return (0);
     EVP_MD_CTX_cleanup(&((BIO_OK_CTX *)a->ptr)->md);
-    OPENSSL_cleanse(a->ptr, sizeof(BIO_OK_CTX));
-    OPENSSL_free(a->ptr);
+    OPENSSL_clear_free(a->ptr, sizeof(BIO_OK_CTX));
     a->ptr = NULL;
     a->init = 0;
     a->flags = 0;

diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
index ce95350bfd991c61225e589bc43c7c91844e7f2e..043830d5ff0a37dd549d5c11199569663b590b9c 100644 (file)
--- a/crypto/evp/digest.c
+++ b/crypto/evp/digest.c
@@ -349,8 +349,7 @@ int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
         ctx->digest->cleanup(ctx);
     if (ctx->digest && ctx->digest->ctx_size && ctx->md_data
         && !EVP_MD_CTX_test_flags(ctx, EVP_MD_CTX_FLAG_REUSE)) {
-        OPENSSL_cleanse(ctx->md_data, ctx->digest->ctx_size);
-        OPENSSL_free(ctx->md_data);
+        OPENSSL_clear_free(ctx->md_data, ctx->digest->ctx_size);
     }
     EVP_PKEY_CTX_free(ctx->pctx);
 #ifndef OPENSSL_NO_ENGINE

diff --git a/crypto/evp/evp_pbe.c b/crypto/evp/evp_pbe.c
index 00fa72d8bbce29255eacc3c9e14bdffafb8adb3c..7a716372c12e9a5c21ec2536dcb20e2f820d0a32 100644 (file)
--- a/crypto/evp/evp_pbe.c
+++ b/crypto/evp/evp_pbe.c
@@ -292,7 +292,7 @@ int EVP_PBE_find(int type, int pbe_nid,
 
 static void free_evp_pbe_ctl(EVP_PBE_CTL *pbe)
 {
-    OPENSSL_freeFunc(pbe);
+    OPENSSL_free(pbe);
 }
 
 void EVP_PBE_cleanup(void)

diff --git a/crypto/evp/p_open.c b/crypto/evp/p_open.c
index adaa42fa1e319135b2d39d75b083de50ef7191be..481c85518a6c5dd510b32cf646f127f7f57a6815 100644 (file)
--- a/crypto/evp/p_open.c
+++ b/crypto/evp/p_open.c
@@ -105,9 +105,7 @@ int EVP_OpenInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
 
     ret = 1;
  err:
-    if (key != NULL)
-        OPENSSL_cleanse(key, size);
-    OPENSSL_free(key);
+    OPENSSL_clear_free(key, size);
     return (ret);
 }
 

diff --git a/crypto/hmac/hm_pmeth.c b/crypto/hmac/hm_pmeth.c
index f2be144c8f7f46cf1629a60dea2f07f7e10d7d16..f53f78c8984f06417b3b5e1019712bf59d2ae619 100644 (file)
--- a/crypto/hmac/hm_pmeth.c
+++ b/crypto/hmac/hm_pmeth.c
@@ -113,13 +113,9 @@ static int pkey_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
 static void pkey_hmac_cleanup(EVP_PKEY_CTX *ctx)
 {
     HMAC_PKEY_CTX *hctx = ctx->data;
+
     HMAC_CTX_cleanup(&hctx->ctx);
-    if (hctx->ktmp.data) {
-        if (hctx->ktmp.length)
-            OPENSSL_cleanse(hctx->ktmp.data, hctx->ktmp.length);
-        OPENSSL_free(hctx->ktmp.data);
-        hctx->ktmp.data = NULL;
-    }
+    OPENSSL_clear_free(hctx->ktmp.data, hctx->ktmp.length);
     OPENSSL_free(hctx);
 }
 

diff --git a/crypto/mem.c b/crypto/mem.c
index afdce778dc03779ba050caa5e6c18b8ad960cf5c..6176b38d75c3b92566d3daf7d7a6f1eb5fe70a9b 100644 (file)
--- a/crypto/mem.c
+++ b/crypto/mem.c
@@ -417,8 +417,7 @@ void *CRYPTO_realloc_clean(void *str, int old_len, int num, const char *file,
     ret = malloc_ex_func(num, file, line);
     if (ret) {
         memcpy(ret, str, old_len);
-        OPENSSL_cleanse(str, old_len);
-        free_func(str);
+        OPENSSL_clear_free(str, old_len);
     }
 #ifdef LEVITTE_DEBUG_MEM
     fprintf(stderr,
@@ -443,6 +442,15 @@ void CRYPTO_free(void *str)
         free_debug_func(NULL, 1);
 }
 
+void CRYPTO_clear_free(void *str, size_t num)
+{
+    if (!str)
+        return;
+    if (num)
+        OPENSSL_cleanse(str, num);
+    CRYPTO_free(str);
+}
+
 void *CRYPTO_remalloc(void *a, int num, const char *file, int line)
 {
     if (a != NULL)

diff --git a/crypto/modes/gcm128.c b/crypto/modes/gcm128.c
index 4ac28b32fb61d4afe18f0a662eb997f094134907..780b326221cde4753e74c123d96760917f64f075 100644 (file)
--- a/crypto/modes/gcm128.c
+++ b/crypto/modes/gcm128.c
@@ -1709,10 +1709,7 @@ GCM128_CONTEXT *CRYPTO_gcm128_new(void *key, block128_f block)
 
 void CRYPTO_gcm128_release(GCM128_CONTEXT *ctx)
 {
-    if (ctx) {
-        OPENSSL_cleanse(ctx, sizeof(*ctx));
-        OPENSSL_free(ctx);
-    }
+    OPENSSL_clear_free(ctx, sizeof(*ctx));
 }
 
 #if defined(SELFTEST)

diff --git a/crypto/modes/ocb128.c b/crypto/modes/ocb128.c
index 0d82e5089c6530d0113f94f43c41f8244920b82a..efa403b0f1502f96aa85ba902d9181994877f721 100644 (file)
--- a/crypto/modes/ocb128.c
+++ b/crypto/modes/ocb128.c
@@ -588,10 +588,7 @@ int CRYPTO_ocb128_tag(OCB128_CONTEXT *ctx, unsigned char *tag, size_t len)
 void CRYPTO_ocb128_cleanup(OCB128_CONTEXT *ctx)
 {
     if (ctx) {
-        if (ctx->l) {
-            OPENSSL_cleanse(ctx->l, ctx->max_l_index * 16);
-            OPENSSL_free(ctx->l);
-        }
+        OPENSSL_clear_free(ctx->l, ctx->max_l_index * 16);
         OPENSSL_cleanse(ctx, sizeof(*ctx));
     }
 }

diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index 431e36804fe5184fd6e3fea6e08c08d994cf8e79..143d001828bc53048e92735a9da100122e3cff3f 100644 (file)
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c
@@ -429,10 +429,7 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp,
     OPENSSL_cleanse(iv, sizeof(iv));
     OPENSSL_cleanse((char *)&ctx, sizeof(ctx));
     OPENSSL_cleanse(buf, PEM_BUFSIZE);
-    if (data != NULL) {
-        OPENSSL_cleanse(data, (unsigned int)dsize);
-        OPENSSL_free(data);
-    }
+    OPENSSL_clear_free(data, (unsigned int)dsize);
     return (ret);
 }
 
@@ -637,8 +634,7 @@ int PEM_write_bio(BIO *bp, const char *name, const char *header,
     EVP_EncodeFinal(&ctx, buf, &outl);
     if ((outl > 0) && (BIO_write(bp, (char *)buf, outl) != outl))
         goto err;
-    OPENSSL_cleanse(buf, PEM_BUFSIZE * 8);
-    OPENSSL_free(buf);
+    OPENSSL_clear_free(buf, PEM_BUFSIZE * 8);
     buf = NULL;
     if ((BIO_write(bp, "-----END ", 9) != 9) ||
         (BIO_write(bp, name, nlen) != nlen) ||
@@ -646,10 +642,7 @@ int PEM_write_bio(BIO *bp, const char *name, const char *header,
         goto err;
     return (i + outl);
  err:
-    if (buf) {
-        OPENSSL_cleanse(buf, PEM_BUFSIZE * 8);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, PEM_BUFSIZE * 8);
     PEMerr(PEM_F_PEM_WRITE_BIO, reason);
     return (0);
 }

diff --git a/crypto/pem/pem_pkey.c b/crypto/pem/pem_pkey.c
index 80c316ed38ab775def0f636ff32c9cd432bf935f..0a110e15b9676c2857ed3879ef73911c15626205 100644 (file)
--- a/crypto/pem/pem_pkey.c
+++ b/crypto/pem/pem_pkey.c
@@ -139,8 +139,7 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
         PEMerr(PEM_F_PEM_READ_BIO_PRIVATEKEY, ERR_R_ASN1_LIB);
  err:
     OPENSSL_free(nm);
-    OPENSSL_cleanse(data, len);
-    OPENSSL_free(data);
+    OPENSSL_clear_free(data, len);
     return (ret);
 }
 

diff --git a/crypto/pem/pvkfmt.c b/crypto/pem/pvkfmt.c
index 14ddb33a263c715fc9d0cc8146e7aededde1d3d0..8ac9348efe8889720f2cc205deeb0e59ddf5832d 100644 (file)
--- a/crypto/pem/pvkfmt.c
+++ b/crypto/pem/pvkfmt.c
@@ -772,10 +772,7 @@ EVP_PKEY *b2i_PVK_bio(BIO *in, pem_password_cb *cb, void *u)
     ret = do_PVK_body(&p, saltlen, keylen, cb, u);
 
  err:
-    if (buf) {
-        OPENSSL_cleanse(buf, buflen);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, buflen);
     return ret;
 }
 

diff --git a/crypto/pkcs12/p12_key.c b/crypto/pkcs12/p12_key.c
index 5a062087d1ec3bb7043c64101190b8ca2c305c2b..45cac04ac6ee9e480c7c6b21714d1688d4528fec 100644 (file)
--- a/crypto/pkcs12/p12_key.c
+++ b/crypto/pkcs12/p12_key.c
@@ -96,10 +96,7 @@ int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt,
                              id, iter, n, out, md_type);
     if (ret <= 0)
         return 0;
-    if (unipass) {
-        OPENSSL_cleanse(unipass, uniplen); /* Clear password from memory */
-        OPENSSL_free(unipass);
-    }
+    OPENSSL_clear_free(unipass, uniplen);
     return ret;
 }
 

diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 51e9c6e80a1741470a92663ffd3d4cdd1e51cfb5..4bc06b95c216132b13afcec8fad978518f2b5e0c 100644 (file)
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -229,11 +229,7 @@ static int pkcs7_decrypt_rinfo(unsigned char **pek, int *peklen,
 
     ret = 1;
 
-    if (*pek) {
-        OPENSSL_cleanse(*pek, *peklen);
-        OPENSSL_free(*pek);
-    }
-
+    OPENSSL_clear_free(*pek, *peklen);
     *pek = ek;
     *peklen = eklen;
 
@@ -576,8 +572,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
              */
             if (!EVP_CIPHER_CTX_set_key_length(evp_ctx, eklen)) {
                 /* Use random key as MMA defence */
-                OPENSSL_cleanse(ek, eklen);
-                OPENSSL_free(ek);
+                OPENSSL_clear_free(ek, eklen);
                 ek = tkey;
                 eklen = tkeylen;
                 tkey = NULL;
@@ -588,16 +583,10 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         if (EVP_CipherInit_ex(evp_ctx, NULL, NULL, ek, NULL, 0) <= 0)
             goto err;
 
-        if (ek) {
-            OPENSSL_cleanse(ek, eklen);
-            OPENSSL_free(ek);
-            ek = NULL;
-        }
-        if (tkey) {
-            OPENSSL_cleanse(tkey, tkeylen);
-            OPENSSL_free(tkey);
-            tkey = NULL;
-        }
+        OPENSSL_clear_free(ek, eklen);
+        ek = NULL;
+        OPENSSL_clear_free(tkey, tkeylen);
+        tkey = NULL;
 
         if (out == NULL)
             out = etmp;
@@ -619,23 +608,16 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
     }
     BIO_push(out, bio);
     bio = NULL;
-    if (0) {
+    return out;
+
  err:
-        if (ek) {
-            OPENSSL_cleanse(ek, eklen);
-            OPENSSL_free(ek);
-        }
-        if (tkey) {
-            OPENSSL_cleanse(tkey, tkeylen);
-            OPENSSL_free(tkey);
-        }
-        BIO_free_all(out);
-        BIO_free_all(btmp);
-        BIO_free_all(etmp);
-        BIO_free_all(bio);
-        out = NULL;
-    }
-    return (out);
+    OPENSSL_clear_free(ek, eklen);
+    OPENSSL_clear_free(tkey, tkeylen);
+    BIO_free_all(out);
+    BIO_free_all(btmp);
+    BIO_free_all(etmp);
+    BIO_free_all(bio);
+    return  NULL;
 }
 
 static BIO *PKCS7_find_digest(EVP_MD_CTX **pmd, BIO *bio, int nid)

diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c
index 0bbaf675e27494caff9eb9f9ce9a97fe8862e7a7..acc116b9a7a419c752106da9be38a41edeb06565 100644 (file)
--- a/crypto/rand/rand_lib.c
+++ b/crypto/rand/rand_lib.c
@@ -207,10 +207,7 @@ static size_t drbg_get_entropy(DRBG_CTX *ctx, unsigned char **pout,
 
 static void drbg_free_entropy(DRBG_CTX *ctx, unsigned char *out, size_t olen)
 {
-    if (out) {
-        OPENSSL_cleanse(out, olen);
-        OPENSSL_free(out);
-    }
+    OPENSSL_clear_free(out, olen);
 }
 
 /*

diff --git a/crypto/rsa/rsa_eay.c b/crypto/rsa/rsa_eay.c
index 73a8e07d35946133a22098080bd376e124284d73..49c157a84269e47fa9c35c94822a7421a0cfb4bd 100644 (file)
--- a/crypto/rsa/rsa_eay.c
+++ b/crypto/rsa/rsa_eay.c
@@ -243,10 +243,7 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
         BN_CTX_end(ctx);
         BN_CTX_free(ctx);
     }
-    if (buf != NULL) {
-        OPENSSL_cleanse(buf, num);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, num);
     return (r);
 }
 
@@ -480,10 +477,7 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
         BN_CTX_end(ctx);
         BN_CTX_free(ctx);
     }
-    if (buf != NULL) {
-        OPENSSL_cleanse(buf, num);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, num);
     return (r);
 }
 
@@ -622,10 +616,7 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
         BN_CTX_end(ctx);
         BN_CTX_free(ctx);
     }
-    if (buf != NULL) {
-        OPENSSL_cleanse(buf, num);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, num);
     return (r);
 }
 
@@ -725,10 +716,7 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
         BN_CTX_end(ctx);
         BN_CTX_free(ctx);
     }
-    if (buf != NULL) {
-        OPENSSL_cleanse(buf, num);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, num);
     return (r);
 }
 

diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c
index 5b4ce734539de1a84458e6424f207419cb7fe96c..1430d5b0f303bbb0536fb2971db6fec4224b76c5 100644 (file)
--- a/crypto/rsa/rsa_lib.c
+++ b/crypto/rsa/rsa_lib.c
@@ -243,8 +243,7 @@ void RSA_free(RSA *r)
         BN_BLINDING_free(r->blinding);
     if (r->mt_blinding != NULL)
         BN_BLINDING_free(r->mt_blinding);
-    if (r->bignum_data != NULL)
-        OPENSSL_free_locked(r->bignum_data);
+    OPENSSL_free_locked(r->bignum_data);
     OPENSSL_free(r);
 }
 

diff --git a/crypto/rsa/rsa_saos.c b/crypto/rsa/rsa_saos.c
index 80709f5369ce2ece9c81fc34b0634e5e783f8b8c..c462ae155db434b618e7e59e06f6a62d635085a4 100644 (file)
--- a/crypto/rsa/rsa_saos.c
+++ b/crypto/rsa/rsa_saos.c
@@ -96,8 +96,7 @@ int RSA_sign_ASN1_OCTET_STRING(int type,
     else
         *siglen = i;
 
-    OPENSSL_cleanse(s, (unsigned int)j + 1);
-    OPENSSL_free(s);
+    OPENSSL_clear_free(s, (unsigned int)j + 1);
     return (ret);
 }
 
@@ -139,9 +138,6 @@ int RSA_verify_ASN1_OCTET_STRING(int dtype,
         ret = 1;
  err:
     ASN1_OCTET_STRING_free(sig);
-    if (s != NULL) {
-        OPENSSL_cleanse(s, (unsigned int)siglen);
-        OPENSSL_free(s);
-    }
+    OPENSSL_clear_free(s, (unsigned int)siglen);
     return (ret);
 }

diff --git a/crypto/rsa/rsa_sign.c b/crypto/rsa/rsa_sign.c
index 3b2ba569a6bc4915a18001b15045d04790126a4d..69657978eb42e0fc5b91f4e0a35d40bc1078d619 100644 (file)
--- a/crypto/rsa/rsa_sign.c
+++ b/crypto/rsa/rsa_sign.c
@@ -131,10 +131,8 @@ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
     else
         *siglen = i;
 
-    if (type != NID_md5_sha1) {
-        OPENSSL_cleanse(tmps, (unsigned int)j + 1);
-        OPENSSL_free(tmps);
-    }
+    if (type != NID_md5_sha1)
+        OPENSSL_clear_free(tmps, (unsigned int)j + 1);
     return (ret);
 }
 
@@ -153,8 +151,7 @@ static int rsa_check_digestinfo(X509_SIG *sig, const unsigned char *dinfo,
         return 0;
     if (derlen == dinfolen && !memcmp(dinfo, der, derlen))
         ret = 1;
-    OPENSSL_cleanse(der, derlen);
-    OPENSSL_free(der);
+    OPENSSL_clear_free(der, derlen);
     return ret;
 }
 
@@ -267,10 +264,7 @@ int int_rsa_verify(int dtype, const unsigned char *m,
     }
  err:
     X509_SIG_free(sig);
-    if (s != NULL) {
-        OPENSSL_cleanse(s, (unsigned int)siglen);
-        OPENSSL_free(s);
-    }
+    OPENSSL_clear_free(s, (unsigned int)siglen);
     return (ret);
 }
 

diff --git a/engines/e_4758cca.c b/engines/e_4758cca.c
index 3b593c79c5943f2c8fbd262b28a848c73bf31a1c..b605a79cfffd1172747493255227ef8bcd16949b 100644 (file)
--- a/engines/e_4758cca.c
+++ b/engines/e_4758cca.c
@@ -709,10 +709,8 @@ static int cca_rsa_verify(int type, const unsigned char *m,
                            &keyTokenLength, keyToken, &length, hashBuffer,
                            &lsiglen, (unsigned char *)sigbuf);
 
-    if (type == NID_sha1 || type == NID_md5) {
-        OPENSSL_cleanse(hashBuffer, keyLength + 1);
-        OPENSSL_free(hashBuffer);
-    }
+    if (type == NID_sha1 || type == NID_md5)
+        OPENSSL_clear_free(hashBuffer, keyLength + 1);
 
     return ((returnCode || reasonCode) ? 0 : 1);
 }
@@ -820,10 +818,8 @@ static int cca_rsa_sign(int type, const unsigned char *m, unsigned int m_len,
                              &keyTokenLength, keyToken, &length, hashBuffer,
                              &outputLength, &outputBitLength, sigret);
 
-    if (type == NID_sha1 || type == NID_md5) {
-        OPENSSL_cleanse(hashBuffer, keyLength + 1);
-        OPENSSL_free(hashBuffer);
-    }
+    if (type == NID_sha1 || type == NID_md5)
+        OPENSSL_clear_free(hashBuffer, keyLength + 1);
 
     *siglen = outputLength;
 

diff --git a/engines/e_sureware.c b/engines/e_sureware.c
index 4580250d98e5c151576dce9f5dab0b84bba37efc..9e56a7d28eab712248f86ce6218c8044b5d32a2a 100644 (file)
--- a/engines/e_sureware.c
+++ b/engines/e_sureware.c
@@ -948,10 +948,7 @@ static int surewarehk_rsa_priv_dec(int flen, const unsigned char *from,
                         SUREWARE_R_PADDING_CHECK_FAILED);
     }
  err:
-    if (buf) {
-        OPENSSL_cleanse(buf, tlen);
-        OPENSSL_free(buf);
-    }
+    OPENSSL_clear_free(buf, tlen);
     return ret;
 }
 

diff --git a/include/openssl/crypto.h b/include/openssl/crypto.h
index 9762398950220197b07b98405d051619f6b34afd..f05084f8c1f776048f3ebcfb53383f631a2faaa7 100644 (file)
--- a/include/openssl/crypto.h
+++ b/include/openssl/crypto.h
@@ -373,7 +373,7 @@ int CRYPTO_is_mem_check_on(void);
         CRYPTO_realloc_clean(addr,old_num,num,__FILE__,__LINE__)
 # define OPENSSL_remalloc(addr,num) \
         CRYPTO_remalloc((char **)addr,(int)num,__FILE__,__LINE__)
-# define OPENSSL_freeFunc        CRYPTO_free
+# define OPENSSL_clear_free(addr, num) CRYPTO_clear_free(addr, num)
 # define OPENSSL_free(addr)      CRYPTO_free(addr)
 
 # define OPENSSL_malloc_locked(num) \
@@ -526,6 +526,7 @@ void CRYPTO_free_locked(void *ptr);
 void *CRYPTO_malloc(int num, const char *file, int line);
 char *CRYPTO_strdup(const char *str, const char *file, int line);
 void CRYPTO_free(void *ptr);
+void CRYPTO_clear_free(void *ptr, size_t num);
 void *CRYPTO_realloc(void *addr, int num, const char *file, int line);
 void *CRYPTO_realloc_clean(void *addr, int old_num, int num, const char *file,
                            int line);

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index bbff778d44210414d59043d53a29b0b41869818a..71756cda2ee8e208759001f2d3d6fc0beafa4c74 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -3073,8 +3073,7 @@ int ssl3_send_client_key_exchange(SSL *s)
                                                         s->
                                                         session->master_key,
                                                         pms, pmslen);
-        OPENSSL_cleanse(pms, pmslen);
-        OPENSSL_free(pms);
+        OPENSSL_clear_free(pms, pmslen);
         s->cert->pms = NULL;
         if (s->session->master_key_length < 0) {
             ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
@@ -3087,11 +3086,8 @@ int ssl3_send_client_key_exchange(SSL *s)
     ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
     SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
  err:
-    if (pms) {
-        OPENSSL_cleanse(pms, pmslen);
-        OPENSSL_free(pms);
-        s->cert->pms = NULL;
-    }
+    OPENSSL_clear_free(pms, pmslen);
+    s->cert->pms = NULL;
 #ifndef OPENSSL_NO_EC
     BN_CTX_free(bn_ctx);
     if (encodedPoint != NULL)

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 8fc5bc4a8a8dab85f14e8224c5f16f69d37caa35..df86f5b9f38e8e408bb830e2c6c6a68ea29d8f44 100644 (file)
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -471,11 +471,8 @@ int ssl3_setup_key_block(SSL *s)
 
 void ssl3_cleanup_key_block(SSL *s)
 {
-    if (s->s3->tmp.key_block != NULL) {
-        OPENSSL_cleanse(s->s3->tmp.key_block, s->s3->tmp.key_block_length);
-        OPENSSL_free(s->s3->tmp.key_block);
-        s->s3->tmp.key_block = NULL;
-    }
+    OPENSSL_clear_free(s->s3->tmp.key_block, s->s3->tmp.key_block_length);
+    s->s3->tmp.key_block = NULL;
     s->s3->tmp.key_block_length = 0;
 }
 

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index ef2ddb49739b92c45a5326c27a9cf8e7788372c9..190d0f1b93c9a2e78a10a2fa08e23569a84bd7b0 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -3138,8 +3138,7 @@ void ssl3_free(SSL *s)
 #ifndef OPENSSL_NO_SRP
     SSL_SRP_CTX_free(s);
 #endif
-    OPENSSL_cleanse(s->s3, sizeof *s->s3);
-    OPENSSL_free(s->s3);
+    OPENSSL_clear_free(s->s3, sizeof *s->s3);
     s->s3 = NULL;
 }
 

diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 0ae9646991065376fd23f5ae83abc74318925c7d..a15c5f9a09306723c911d4977ffac6c146267336 100644 (file)
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -465,11 +465,8 @@ void ssl_cert_free(CERT *c)
     custom_exts_free(&c->cli_ext);
     custom_exts_free(&c->srv_ext);
 #endif
-    if (c->pms) {
-        OPENSSL_cleanse(c->pms, c->pmslen);
-        OPENSSL_free(c->pms);
-        c->pms = NULL;
-    }
+    OPENSSL_clear_free(c->pms, c->pmslen);
+    c->pms = NULL;
     OPENSSL_free(c);
 }
 

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index eed38ca73cdd6d8543aab2fa3e8c480dec813dc0..cec590529150b0d35bb11a79b675fefd7ae02224 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -759,8 +759,7 @@ void SSL_SESSION_free(SSL_SESSION *ss)
     if (ss->srp_username != NULL)
         OPENSSL_free(ss->srp_username);
 #endif
-    OPENSSL_cleanse(ss, sizeof(*ss));
-    OPENSSL_free(ss);
+    OPENSSL_clear_free(ss, sizeof(*ss));
 }
 
 int SSL_set_session(SSL *s, SSL_SESSION *session)

diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 1f58ed017b57bb8da04c78729c386caf62d69ef6..edb65582f0a4d3cbfa5eaae94d66e5672a14b895 100644 (file)
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -717,10 +717,7 @@ int tls1_setup_key_block(SSL *s)
 
     ret = 1;
  err:
-    if (p2) {
-        OPENSSL_cleanse(p2, num);
-        OPENSSL_free(p2);
-    }
+    OPENSSL_clear_free(p2, num);
     return (ret);
 }
 

diff --git a/ssl/tls_srp.c b/ssl/tls_srp.c
index 33d398fff793b3aa174bbcfea006cc72e4b3e805..5d895ccab389aa1d6547e3dc5eadf8af8a8dcf27 100644 (file)
--- a/ssl/tls_srp.c
+++ b/ssl/tls_srp.c
@@ -339,7 +339,7 @@ int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
 int SRP_generate_server_master_secret(SSL *s, unsigned char *master_key)
 {
     BIGNUM *K = NULL, *u = NULL;
-    int ret = -1, tmp_len;
+    int ret = -1, tmp_len = 0;
     unsigned char *tmp = NULL;
 
     if (!SRP_Verify_A_mod_N(s->srp_ctx.A, s->srp_ctx.N))
@@ -360,10 +360,7 @@ int SRP_generate_server_master_secret(SSL *s, unsigned char *master_key)
         s->method->ssl3_enc->generate_master_secret(s, master_key, tmp,
                                                     tmp_len);
  err:
-    if (tmp) {
-        OPENSSL_cleanse(tmp, tmp_len);
-        OPENSSL_free(tmp);
-    }
+    OPENSSL_clear_free(tmp, tmp_len);
     BN_clear_free(K);
     BN_clear_free(u);
     return ret;
@@ -373,7 +370,7 @@ int SRP_generate_server_master_secret(SSL *s, unsigned char *master_key)
 int SRP_generate_client_master_secret(SSL *s, unsigned char *master_key)
 {
     BIGNUM *x = NULL, *u = NULL, *K = NULL;
-    int ret = -1, tmp_len;
+    int ret = -1, tmp_len = 0;
     char *passwd = NULL;
     unsigned char *tmp = NULL;
 
@@ -407,16 +404,10 @@ int SRP_generate_client_master_secret(SSL *s, unsigned char *master_key)
         s->method->ssl3_enc->generate_master_secret(s, master_key, tmp,
                                                     tmp_len);
  err:
-    if (tmp) {
-        OPENSSL_cleanse(tmp, tmp_len);
-        OPENSSL_free(tmp);
-    }
+    OPENSSL_clear_free(tmp, tmp_len);
     BN_clear_free(K);
     BN_clear_free(x);
-    if (passwd) {
-        OPENSSL_cleanse(passwd, strlen(passwd));
-        OPENSSL_free(passwd);
-    }
+    OPENSSL_clear_free(passwd, strlen(passwd));
     BN_clear_free(u);
     return ret;
 }

diff --git a/util/libeay.num b/util/libeay.num
index 553a160096dbfdc226460debd0126ef8b3e5a5aa..bc4bb44383e97aaa54ce66feb60e83200e40bc9d 100755 (executable)
--- a/util/libeay.num
+++ b/util/libeay.num
@@ -4555,3 +4555,5 @@ OBJ_get0_data                           4913      EXIST::FUNCTION:
 X509_NAME_ENTRY_set                     4914   EXIST::FUNCTION:
 ASN1_TYPE_pack_sequence                 4915   EXIST::FUNCTION:
 ASN1_TYPE_unpack_sequence               4916   EXIST::FUNCTION:
+CRYPTO_clean_free                       4917   NOEXIST::FUNCTION:
+CRYPTO_clear_free                       4918   EXIST::FUNCTION: