sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Make memwipe() do nothing when passed a NULL pointer or zero size 

Check size argument to memwipe() for underflow.

Closes bug #18089. Reported by "gk", patch by "teor".
Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
commit 49dd5ef3 on 7 Nov 2012.
This commit is contained in:
teor (Tim Wilson-Brown) 2016-01-19 11:22:58 +11:00 committed by Nick Mathewson
parent 053e11f397
commit fb7d1f41b4
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
changes/bug18089 Normal file
View File

@ -0,0 +1,6 @@
o Minor fixes (security):
- Make memwipe() do nothing when passed a NULL pointer
or zero size. Check size argument to memwipe() for underflow.
Closes bug #18089. Reported by "gk", patch by "teor".
Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
commit 49dd5ef3 on 7 Nov 2012.

8
src/common/crypto.c
View File

@ -2972,6 +2972,7 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret,
/**
* Destroy the <b>sz</b> bytes of data stored at <b>mem</b>, setting them to
* the value <b>byte</b>.
* If <b>mem</b> is NULL or <b>sz</b> is zero, nothing happens.
*
* This function is preferable to memset, since many compilers will happily
* optimize out memset() when they can convince themselves that the data being
@ -2989,6 +2990,13 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret,
void
memwipe(void *mem, uint8_t byte, size_t sz)
{
if (mem == NULL || sz == 0) {
return;
}
/* Data this large is likely to be an underflow. */
tor_assert(sz < SIZE_T_CEILING);
/* Because whole-program-optimization exists, we may not be able to just
* have this function call "memset". A smart compiler could inline it, then
* eliminate dead memsets, and declare itself to be clever. */