Commit c9dd49a7 authored by Matt Caswell's avatar Matt Caswell
Browse files

Cleanse buffers 



Cleanse various intermediate buffers used by the PRF.

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
parent 06c6a2b4

ssl/s3_enc.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -871,6 +871,7 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, 
                        s, s->msg_callback_arg);

                        s, s->msg_callback_arg);

    }

    }

#endif

#endif

    OPENSSL_cleanse(buf, sizeof buf);

    return (ret);

    return (ret);

}

}

ssl/t1_enc.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -949,6 +949,8 @@ int tls1_final_finish_mac(SSL *s, const char *str, int slen, 
                  s->session->master_key, s->session->master_key_length,

                  s->session->master_key, s->session->master_key_length,

                  out, buf2, sizeof buf2))

                  out, buf2, sizeof buf2))

        return 0;

        return 0;

    OPENSSL_cleanse(hash, hashlen);

    OPENSSL_cleanse(buf2, sizeof(buf2));

    return sizeof buf2;

    return sizeof buf2;

}

}
@@ -1112,6 +1114,7 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, 
                 s->s3->server_random, SSL3_RANDOM_SIZE,

                 s->s3->server_random, SSL3_RANDOM_SIZE,

                 NULL, 0, p, len, s->session->master_key, buff, sizeof buff);

                 NULL, 0, p, len, s->session->master_key, buff, sizeof buff);

    }

    }

    OPENSSL_cleanse(buff, sizeof buff);

#ifdef SSL_DEBUG

#ifdef SSL_DEBUG

    fprintf(stderr, "Premaster Secret:\n");

    fprintf(stderr, "Premaster Secret:\n");

    BIO_dump_fp(stderr, (char *)p, len);

    BIO_dump_fp(stderr, (char *)p, len);
@@ -1225,6 +1228,8 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen, 
                  NULL, 0,

                  NULL, 0,

                  s->session->master_key, s->session->master_key_length,

                  s->session->master_key, s->session->master_key_length,

                  out, buff, olen);

                  out, buff, olen);

    OPENSSL_cleanse(val, vallen);

    OPENSSL_cleanse(buff, olen);





#ifdef KSSL_DEBUG

#ifdef KSSL_DEBUG

    fprintf(stderr, "tls1_export_keying_material() complete\n");

    fprintf(stderr, "tls1_export_keying_material() complete\n");