From b5b39779f3dfe811a64899bd8b33397647dda57a Mon Sep 17 00:00:00 2001 From: Shane Lontis Date: Tue, 4 Sep 2018 14:01:37 +1000 Subject: [PATCH] hkdf zeroization fix Reviewed-by: Paul Yang Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/7106) (cherry picked from commit 64ed55ab033f1bfa795d46f0ecc61c313204b418) --- crypto/kdf/hkdf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/crypto/kdf/hkdf.c b/crypto/kdf/hkdf.c index 00b95b5a88..6d38a2fded 100644 --- a/crypto/kdf/hkdf.c +++ b/crypto/kdf/hkdf.c @@ -234,6 +234,7 @@ static unsigned char *HKDF_Expand(const EVP_MD *evp_md, unsigned char *okm, size_t okm_len) { HMAC_CTX *hmac; + unsigned char *ret = NULL; unsigned int i; @@ -283,11 +284,10 @@ static unsigned char *HKDF_Expand(const EVP_MD *evp_md, done_len += copy_len; } - - HMAC_CTX_free(hmac); - return okm; + ret = okm; err: + OPENSSL_cleanse(prev, sizeof(prev)); HMAC_CTX_free(hmac); - return NULL; + return ret; } -- 2.25.1