[openssl-commits] [openssl] OpenSSL_1_0_1-stable update

[Matt Caswell]

The branch OpenSSL_1_0_1-stable has been updated
       via  58d8a271ab1eb38fc2983519fb3c37a900df41cf (commit)
      from  8b7e469d06d7c487342eef1dcca3dc02fe7cd267 (commit)


- Log -----------------------------------------------------------------
commit 58d8a271ab1eb38fc2983519fb3c37a900df41cf
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Mar 9 13:59:58 2015 +0000

    Cleanse buffers
    
    Cleanse various intermediate buffers used by the PRF (backported version
    from master).
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit 35fafc4dbc0b3a717ad1b208fe2867e8c64867de)
    
    Conflicts:
    	ssl/s3_enc.c

-----------------------------------------------------------------------

Summary of changes:
 ssl/s3_enc.c | 1 +
 ssl/t1_enc.c | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index b4a1456..152f40d 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -841,6 +841,7 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
         ret += n;
     }
     EVP_MD_CTX_cleanup(&ctx);
+    OPENSSL_cleanse(buf, sizeof buf);
     return (ret);
 }
 
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 0d70116..fa1c002 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -958,6 +958,8 @@ int tls1_final_finish_mac(SSL *s,
         err = 1;
     EVP_MD_CTX_cleanup(&ctx);
 
+    OPENSSL_cleanse(buf, (int)(q - buf));
+    OPENSSL_cleanse(buf2, sizeof(buf2));
     if (err)
         return 0;
     else
@@ -1121,6 +1123,7 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
              co, col,
              s->s3->server_random, SSL3_RANDOM_SIZE,
              so, sol, p, len, s->session->master_key, buff, sizeof buff);
+    OPENSSL_cleanse(buff, sizeof buff);
 #ifdef SSL_DEBUG
     fprintf(stderr, "Premaster Secret:\n");
     BIO_dump_fp(stderr, (char *)p, len);
@@ -1215,6 +1218,8 @@ int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
                   NULL, 0,
                   s->session->master_key, s->session->master_key_length,
                   out, buff, olen);
+    OPENSSL_cleanse(val, vallen);
+    OPENSSL_cleanse(buff, olen);
 
 #ifdef KSSL_DEBUG
     fprintf(stderr, "tls1_export_keying_material() complete\n");