lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-04-26 15:08:51 +03:00
Code

Zeroize temporary heap buffers used in PSA operations

Browse Source 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2025-03-06 12:41:39 +01:00
parent c811fb79ad
commit e847afd9ef
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog.d/psa-zeroize.txt Normal file
View File

@ -0,0 +1,2 @@
Security
* Zeroize temporary heap buffers used in PSA operations.

6
library/psa_crypto.c
View File

@ -9300,7 +9300,7 @@ psa_status_t psa_crypto_local_input_alloc(const uint8_t *input, size_t input_len
return PSA_SUCCESS; return PSA_SUCCESS;
error: error:
mbedtls_free(local_input->buffer); mbedtls_zeroize_and_free(local_input->buffer, local_input->length);
local_input->buffer = NULL; local_input->buffer = NULL;
local_input->length = 0; local_input->length = 0;
return status; return status;
@ -9308,7 +9308,7 @@ error:
void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input) void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input)
{ {
mbedtls_free(local_input->buffer); mbedtls_zeroize_and_free(local_input->buffer, local_input->length);
local_input->buffer = NULL; local_input->buffer = NULL;
local_input->length = 0; local_input->length = 0;
} }
@ -9352,7 +9352,7 @@ psa_status_t psa_crypto_local_output_free(psa_crypto_local_output_t *local_outpu
return status; return status;
} }
mbedtls_free(local_output->buffer); mbedtls_zeroize_and_free(local_output->buffer, local_output->length);
local_output->buffer = NULL; local_output->buffer = NULL;
local_output->length = 0; local_output->length = 0;