generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Cleanse PKCS#8 private key components.

Browse Source 
New function ASN1_STRING_clear_free which cleanses an ASN1_STRING
structure before freeing it.

Call ASN1_STRING_clear_free on PKCS#8 private key components.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit a8ae0891d4bfd18f224777aed1fbb172504421f1)
This commit is contained in:
Dr. Stephen Henson 2015-03-03 14:20:23 +00:00
parent 876ed10574
commit cb9d5b7b53
4 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
crypto/asn1/asn1.h
View File

@ -795,6 +795,7 @@ DECLARE_ASN1_SET_OF(ASN1_OBJECT)
ASN1_STRING *ASN1_STRING_new(void); ASN1_STRING *ASN1_STRING_new(void);
void ASN1_STRING_free(ASN1_STRING *a); void ASN1_STRING_free(ASN1_STRING *a);
void ASN1_STRING_clear_free(ASN1_STRING *a);
int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str); int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str);
ASN1_STRING *ASN1_STRING_dup(const ASN1_STRING *a); ASN1_STRING *ASN1_STRING_dup(const ASN1_STRING *a);
ASN1_STRING *ASN1_STRING_type_new(int type); ASN1_STRING *ASN1_STRING_type_new(int type);

7
crypto/asn1/asn1_lib.c
View File

@ -430,6 +430,13 @@ void ASN1_STRING_free(ASN1_STRING *a)
OPENSSL_free(a); OPENSSL_free(a);
} }
void ASN1_STRING_clear_free(ASN1_STRING *a)
{
if (a && a->data && !(a->flags & ASN1_STRING_FLAG_NDEF))
OPENSSL_cleanse(a->data, a->length);
ASN1_STRING_free(a);
}
int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b) int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
{ {
int i; int i;

8
crypto/dh/dh_ameth.c
View File

@ -215,7 +215,7 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
EVP_PKEY_assign_DH(pkey, dh); EVP_PKEY_assign_DH(pkey, dh);
ASN1_INTEGER_free(privkey); ASN1_STRING_clear_free(privkey);
return 1; return 1;
@ -223,7 +223,7 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
DHerr(DH_F_DH_PRIV_DECODE, EVP_R_DECODE_ERROR); DHerr(DH_F_DH_PRIV_DECODE, EVP_R_DECODE_ERROR);
dherr: dherr:
DH_free(dh); DH_free(dh);
ASN1_INTEGER_free(privkey); ASN1_STRING_clear_free(privkey);
return 0; return 0;
} }
@ -258,7 +258,7 @@ static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
dplen = i2d_ASN1_INTEGER(prkey, &dp); dplen = i2d_ASN1_INTEGER(prkey, &dp);
ASN1_INTEGER_free(prkey); ASN1_STRING_clear_free(prkey);
prkey = NULL; prkey = NULL;
if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dhKeyAgreement), 0, if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dhKeyAgreement), 0,
@ -273,7 +273,7 @@ static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
if (params != NULL) if (params != NULL)
ASN1_STRING_free(params); ASN1_STRING_free(params);
if (prkey != NULL) if (prkey != NULL)
ASN1_INTEGER_free(prkey); ASN1_STRING_clear_free(prkey);
return 0; return 0;
} }

10
crypto/dsa/dsa_ameth.c
View File

@ -226,7 +226,7 @@ static int dsa_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
goto decerr; goto decerr;
if (privkey->type == V_ASN1_NEG_INTEGER) { if (privkey->type == V_ASN1_NEG_INTEGER) {
p8->broken = PKCS8_NEG_PRIVKEY; p8->broken = PKCS8_NEG_PRIVKEY;
ASN1_INTEGER_free(privkey); ASN1_STRING_clear_free(privkey);
if (!(privkey = d2i_ASN1_UINTEGER(NULL, &q, pklen))) if (!(privkey = d2i_ASN1_UINTEGER(NULL, &q, pklen)))
goto decerr; goto decerr;
} }
@ -264,7 +264,7 @@ static int dsa_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
if (ndsa) if (ndsa)
sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free); sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free);
else else
ASN1_INTEGER_free(privkey); ASN1_STRING_clear_free(privkey);
return 1; return 1;
@ -273,7 +273,7 @@ static int dsa_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
dsaerr: dsaerr:
BN_CTX_free(ctx); BN_CTX_free(ctx);
if (privkey) if (privkey)
ASN1_INTEGER_free(privkey); ASN1_STRING_clear_free(privkey);
sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free); sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free);
DSA_free(dsa); DSA_free(dsa);
return 0; return 0;
@ -315,7 +315,7 @@ static int dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
dplen = i2d_ASN1_INTEGER(prkey, &dp); dplen = i2d_ASN1_INTEGER(prkey, &dp);
ASN1_INTEGER_free(prkey); ASN1_STRING_clear_free(prkey);
if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dsa), 0, if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dsa), 0,
V_ASN1_SEQUENCE, params, dp, dplen)) V_ASN1_SEQUENCE, params, dp, dplen))
@ -329,7 +329,7 @@ static int dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
if (params != NULL) if (params != NULL)
ASN1_STRING_free(params); ASN1_STRING_free(params);
if (prkey != NULL) if (prkey != NULL)
ASN1_INTEGER_free(prkey); ASN1_STRING_clear_free(prkey);
return 0; return 0;
} }