lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-30 22:43:08 +03:00
Code Activity

Zeroize temporary heap buffers used in PSA operations

Browse Source 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
2025-03-06 12:41:39 +01:00
parent c43a9d5576
commit 466ebe8ced
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog.d/psa-zeroize.txt Normal file
View File

@ -0,0 +1,2 @@
Security
* Zeroize temporary heap buffers used in PSA operations.

21
library/psa_crypto.c
View File

@ -6171,16 +6171,22 @@ psa_status_t psa_crypto_local_input_alloc(const uint8_t *input, size_t input_len
return PSA_SUCCESS; return PSA_SUCCESS;
error: error:
mbedtls_free(local_input->buffer); if (local_input->buffer != NULL) {
local_input->buffer = NULL; mbedtls_platform_zeroize(local_input->buffer, local_input->length);
mbedtls_free(local_input->buffer);
local_input->buffer = NULL;
}
local_input->length = 0; local_input->length = 0;
return status; return status;
} }
void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input) void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input)
{ {
mbedtls_free(local_input->buffer); if (local_input->buffer != NULL) {
local_input->buffer = NULL; mbedtls_platform_zeroize(local_input->buffer, local_input->length);
mbedtls_free(local_input->buffer);
local_input->buffer = NULL;
}
local_input->length = 0; local_input->length = 0;
} }
@ -6223,8 +6229,11 @@ psa_status_t psa_crypto_local_output_free(psa_crypto_local_output_t *local_outpu
return status; return status;
} }
mbedtls_free(local_output->buffer); if (local_output->buffer != NULL) {
local_output->buffer = NULL; mbedtls_platform_zeroize(local_output->buffer, local_output->length);
mbedtls_free(local_output->buffer);
local_output->buffer = NULL;
}
local_output->length = 0; local_output->length = 0;
return PSA_SUCCESS; return PSA_SUCCESS;