diff options
| author | Neil Horman <nhorman@openssl.org> | 2024-01-03 13:47:05 -0500 |
|---|---|---|
| committer | Neil Horman <nhorman@openssl.org> | 2024-01-05 14:41:33 -0500 |
| commit | e6c14133c11ab37f0653e0ffeece50baa7ed3161 (patch) | |
| tree | 6e502b3bfe7245e5a3be2e288ed41504fa13912b | |
| parent | bdb3c6d6a2babb31bf145e3d0094e4b91b74c969 (diff) | |
cleanse stack variable in kdf_pbkdf1_do_derive
kdf_pbkdf1_do_derive stores key derivation information in a stack
variable, which is left uncleansed prior to returning. Ensure that the
stack information is zeroed prior to return to avoid potential leaks of
key information
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23194)
(cherry picked from commit 5963aa8c196d7c5a940a979299a07418527932af)
| -rw-r--r-- | providers/implementations/kdfs/pbkdf1.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/providers/implementations/kdfs/pbkdf1.c b/providers/implementations/kdfs/pbkdf1.c index 4fa6afd104..33e0ee6009 100644 --- a/providers/implementations/kdfs/pbkdf1.c +++ b/providers/implementations/kdfs/pbkdf1.c @@ -89,6 +89,7 @@ static int kdf_pbkdf1_do_derive(const unsigned char *pass, size_t passlen, memcpy(out, md_tmp, n); ret = 1; err: + OPENSSL_cleanse(md_tmp, EVP_MAX_MD_SIZE); EVP_MD_CTX_free(ctx); return ret; } |