From 64ed55ab033f1bfa795d46f0ecc61c313204b418 Mon Sep 17 00:00:00 2001 From: Shane Lontis Date: Tue, 4 Sep 2018 14:01:37 +1000 Subject: [PATCH] hkdf zeroization fix Reviewed-by: Paul Yang Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/7106) --- crypto/kdf/hkdf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/crypto/kdf/hkdf.c b/crypto/kdf/hkdf.c index baaa16f0b7..ec6090ad6a 100644 --- a/crypto/kdf/hkdf.c +++ b/crypto/kdf/hkdf.c @@ -281,6 +281,7 @@ static unsigned char *HKDF_Expand(const EVP_MD *evp_md, unsigned char *okm, size_t okm_len) { HMAC_CTX *hmac; + unsigned char *ret = NULL; unsigned int i; @@ -330,11 +331,10 @@ static unsigned char *HKDF_Expand(const EVP_MD *evp_md, done_len += copy_len; } - - HMAC_CTX_free(hmac); - return okm; + ret = okm; err: + OPENSSL_cleanse(prev, sizeof(prev)); HMAC_CTX_free(hmac); - return NULL; + return ret; } -- 2.25.1