Commit 9a3a58e1 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Cleanse PEM buffers before freeing them. 

Submitted by: Benjamin Bennett <ben@psc.edu>
parent 3bd95a14

CHANGES

+4 −0
Original line number Diff line number Diff line
@@ -4,6 +4,10 @@ 


 Changes between 0.9.7l and 0.9.7m  [xx XXX xxxx]



  *) Cleanse PEM buffers before freeing them since they may contain 

     sensitive data.

     [Benjamin Bennett <ben@psc.edu>]



  *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that

     a ciphersuite string such as "DEFAULT:RSA" cannot enable

     authentication-only ciphersuites.

crypto/pem/pem_lib.c

+4 −1
Original line number Diff line number Diff line
@@ -577,6 +577,7 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data, 
		}

	EVP_EncodeFinal(&ctx,buf,&outl);

	if ((outl > 0) && (BIO_write(bp,(char *)buf,outl) != outl)) goto err;

	OPENSSL_cleanse(buf, PEM_BUFSIZE*8);

	OPENSSL_free(buf);

	buf = NULL;

	if (	(BIO_write(bp,"-----END ",9) != 9) ||
@@ -585,8 +586,10 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data, 
		goto err;

	return(i+outl);

err:

	if (buf)

	if (buf) {

		OPENSSL_cleanse(buf, PEM_BUFSIZE*8);

		OPENSSL_free(buf);

	}

	PEMerr(PEM_F_PEM_WRITE_BIO,reason);

	return(0);

	}

crypto/pem/pem_pkey.c

+1 −0
Original line number Diff line number Diff line
@@ -122,6 +122,7 @@ p8err: 
		PEMerr(PEM_F_PEM_ASN1_READ_BIO,ERR_R_ASN1_LIB);

err:

	OPENSSL_free(nm);

	OPENSSL_cleanse(data, len);

	OPENSSL_free(data);

	return(ret);

	}