lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-12-14 02:22:15 +03:00
Code Activity

Merge pull request #1317 from gilles-peskine-arm/zeroize-psa-202503-2.28

Browse Source 
Backport 2.28: Zeroize PSA temporary heap buffers
This commit is contained in:
Gilles Peskine
2025-03-11 17:38:36 +01:00
committed by GitHub
parent c43a9d5576 466ebe8ced
commit a0b25120db
2 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog.d/psa-zeroize.txt Normal file
View File

@@ -0,0 +1,2 @@
Security
* Zeroize temporary heap buffers used in PSA operations.

21
library/psa_crypto.c
View File

@@ -6171,16 +6171,22 @@ psa_status_t psa_crypto_local_input_alloc(const uint8_t *input, size_t input_len
return PSA_SUCCESS;
error:
mbedtls_free(local_input->buffer);
local_input->buffer = NULL;
if (local_input->buffer != NULL) {
mbedtls_platform_zeroize(local_input->buffer, local_input->length);
mbedtls_free(local_input->buffer);
local_input->buffer = NULL;
}
local_input->length = 0;
return status;
}
void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input)
{
mbedtls_free(local_input->buffer);
local_input->buffer = NULL;
if (local_input->buffer != NULL) {
mbedtls_platform_zeroize(local_input->buffer, local_input->length);
mbedtls_free(local_input->buffer);
local_input->buffer = NULL;
}
local_input->length = 0;
}
@@ -6223,8 +6229,11 @@ psa_status_t psa_crypto_local_output_free(psa_crypto_local_output_t *local_outpu
return status;
}
mbedtls_free(local_output->buffer);
local_output->buffer = NULL;
if (local_output->buffer != NULL) {
mbedtls_platform_zeroize(local_output->buffer, local_output->length);
mbedtls_free(local_output->buffer);
local_output->buffer = NULL;
}
local_output->length = 0;
return PSA_SUCCESS;