From: Matt Caswell <matt@openssl.org>
Date: Mon, 9 Mar 2015 13:59:58 +0000 (+0000)
Subject: Cleanse buffers
X-Git-Tag: OpenSSL_1_1_0-pre1~1563
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=c9dd49a751d4e73e6d891c006bb1d835ebfb8493;p=oweals%2Fopenssl.git

Cleanse buffers

Cleanse various intermediate buffers used by the PRF.

Reviewed-by: Richard Levitte <levitte@openssl.org>
---

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 8dda5d0735..83a576ad1a 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -871,6 +871,7 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
                         s, s->msg_callback_arg);
     }
 #endif
+    OPENSSL_cleanse(buf, sizeof buf);
     return (ret);
 }
 
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 6fad8be356..1833eb7646 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -949,6 +949,8 @@ int tls1_final_finish_mac(SSL *s, const char *str, int slen,
                   s->session->master_key, s->session->master_key_length,
                   out, buf2, sizeof buf2))
         return 0;
+    OPENSSL_cleanse(hash, hashlen);
+    OPENSSL_cleanse(buf2, sizeof(buf2));
     return sizeof buf2;
 }
 
@@ -1112,6 +1114,7 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
                  s->s3->server_random, SSL3_RANDOM_SIZE,
                  NULL, 0, p, len, s->session->master_key, buff, sizeof buff);
     }
+    OPENSSL_cleanse(buff, sizeof buff);
 #ifdef SSL_DEBUG
     fprintf(stderr, "Premaster Secret:\n");
     BIO_dump_fp(stderr, (char *)p, len);
@@ -1225,6 +1228,8 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
                   NULL, 0,
                   s->session->master_key, s->session->master_key_length,
                   out, buff, olen);
+    OPENSSL_cleanse(val, vallen);
+    OPENSSL_cleanse(buff, olen);
 
 #ifdef KSSL_DEBUG
     fprintf(stderr, "tls1_export_keying_material() complete\n");