diff options
| -rw-r--r-- | changes/bug2384 | 3 | ||||
| -rw-r--r-- | src/or/rendclient.c | 2 | ||||
| -rw-r--r-- | src/or/rendservice.c | 2 |
3 files changed, 6 insertions, 1 deletions
diff --git a/changes/bug2384 b/changes/bug2384 index 5321814424..ded5eee992 100644 --- a/changes/bug2384 +++ b/changes/bug2384 @@ -1,5 +1,6 @@ o Minor bugfixes - Zero out a few more keys in memory before freeing them. Fixes bug - 2384. Found by cypherpunks. Bugfix on 0.0.2pre9. + 2384 and part of bug 2385. These key instances found by + "cypherpunks". Bugfix on 0.0.2pre9. diff --git a/src/or/rendclient.c b/src/or/rendclient.c index ab18d35298..95875465cb 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -717,8 +717,10 @@ rend_client_receive_rendezvous(origin_circuit_t *circ, const uint8_t *request, * attach only the connections that are waiting on this circuit, rather * than trying to attach them all. See comments bug 743. */ connection_ap_attach_pending(); + memset(keys, 0, sizeof(keys)); return 0; err: + memset(keys, 0, sizeof(keys)); circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL); return -1; } diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 07f01aead9..a650eda405 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1214,8 +1214,10 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, memcpy(cpath->handshake_digest, keys, DIGEST_LEN); if (extend_info) extend_info_free(extend_info); + memset(keys, 0, sizeof(keys)); return 0; err: + memset(keys, 0, sizeof(keys)); if (dh) crypto_dh_free(dh); if (launched) circuit_mark_for_close(TO_CIRCUIT(launched), reason); |