diff options
| author | Nick Mathewson <nickm@torproject.org> | 2017-02-07 08:34:08 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2017-02-07 08:34:08 -0500 |
| commit | 332543baedcf651b75722e5d4626c62fdd24ef60 (patch) | |
| tree | c73f1d6eabdf19e30061d047cdd6a84574c90b9a | |
| parent | 640b4022324c19cf330a26b8d42b6bf7707346ce (diff) | |
| parent | 6cb8c0fd4e9c544710b1ad72a695feb87a1d7ee7 (diff) | |
| download | tor-332543baedcf651b75722e5d4626c62fdd24ef60.tar.gz tor-332543baedcf651b75722e5d4626c62fdd24ef60.zip | |
Merge branch 'maint-0.2.4' into maint-0.2.5
| -rw-r--r-- | changes/bug18089 | 6 | ||||
| -rw-r--r-- | src/common/crypto.c | 10 |
2 files changed, 16 insertions, 0 deletions
diff --git a/changes/bug18089 b/changes/bug18089 new file mode 100644 index 0000000000..c1fb342f77 --- /dev/null +++ b/changes/bug18089 @@ -0,0 +1,6 @@ + o Minor fixes (security): + - Make memwipe() do nothing when passed a NULL pointer + or zero size. Check size argument to memwipe() for underflow. + Closes bug #18089. Reported by "gk", patch by "teor". + Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352), + commit 49dd5ef3 on 7 Nov 2012. diff --git a/src/common/crypto.c b/src/common/crypto.c index f4e86683d9..43bf5bd6b6 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -3056,6 +3056,7 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret, /** * Destroy the <b>sz</b> bytes of data stored at <b>mem</b>, setting them to * the value <b>byte</b>. + * If <b>mem</b> is NULL or <b>sz</b> is zero, nothing happens. * * This function is preferable to memset, since many compilers will happily * optimize out memset() when they can convince themselves that the data being @@ -3073,6 +3074,15 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret, void memwipe(void *mem, uint8_t byte, size_t sz) { + if (sz == 0) { + return; + } + /* If sz is nonzero, then mem must not be NULL. */ + tor_assert(mem != NULL); + + /* Data this large is likely to be an underflow. */ + tor_assert(sz < SIZE_T_CEILING); + /* Because whole-program-optimization exists, we may not be able to just * have this function call "memset". A smart compiler could inline it, then * eliminate dead memsets, and declare itself to be clever. */ |