Commit c2f5de13 authored by Matt Caswell's avatar Matt Caswell
Browse files

Cleanse buffers 



Cleanse various intermediate buffers used by the PRF (backported version
from master).

Conflicts:
	ssl/s3_enc.c

Conflicts:
	ssl/t1_enc.c

Conflicts:
	ssl/t1_enc.c

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
parent 01320ad3

ssl/s3_enc.c

+1 −0
Original line number Diff line number Diff line
@@ -712,6 +712,7 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, 
        ret += n;

    }

    EVP_MD_CTX_cleanup(&ctx);

    OPENSSL_cleanse(buf, sizeof buf);

    return (ret);

}

ssl/t1_enc.c

+4 −0
Original line number Diff line number Diff line
@@ -707,6 +707,8 @@ int tls1_final_finish_mac(SSL *s, EVP_MD_CTX *in1_ctx, EVP_MD_CTX *in2_ctx, 
             out, buf2, sizeof buf2);

    EVP_MD_CTX_cleanup(&ctx);



    OPENSSL_cleanse(buf, (int)(q - buf));

    OPENSSL_cleanse(buf2, sizeof(buf2));

    return sizeof buf2;

}
@@ -850,6 +852,8 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p, 
    tls1_PRF(s->ctx->md5, s->ctx->sha1,

             buf, TLS_MD_MASTER_SECRET_CONST_SIZE + SSL3_RANDOM_SIZE * 2, p,

             len, s->session->master_key, buff, sizeof buff);

    OPENSSL_cleanse(buf, sizeof buf);

    OPENSSL_cleanse(buff, sizeof buff);

#ifdef KSSL_DEBUG

    printf("tls1_generate_master_secret() complete\n");

#endif                          /* KSSL_DEBUG */