From: Shane Lontis <shane.lontis@oracle.com>
Date: Tue, 4 Sep 2018 05:12:13 +0000 (+1000)
Subject: key zeroization fix for a branch path of tls13_final_finish_mac
X-Git-Tag: OpenSSL_1_1_1~48
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=8f39d8af7de12d5ac8699e54cf2fd8ae2325bcf2;p=oweals%2Fopenssl.git

key zeroization fix for a branch path of tls13_final_finish_mac

Reviewed-by: Paul Yang <yang.yang@baishancloud.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7110)
---

diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c
index 22db2f8237..f7ab0fa470 100644
--- a/ssl/tls13_enc.c
+++ b/ssl/tls13_enc.c
@@ -271,6 +271,7 @@ size_t tls13_final_finish_mac(SSL *s, const char *str, size_t slen,
 
         key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, finsecret,
                                            hashlen);
+        OPENSSL_cleanse(finsecret, sizeof(finsecret));
     }
 
     if (key == NULL