yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-26 08:55:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #732 from gabor-mezei-arm/689_bp216_zeroising_of_plaintext_buffers

Browse Source 
[Backport 2.16] Zeroising of plaintext buffers in mbedtls_ssl_read()
This commit is contained in:
Gilles Peskine 2020-08-12 18:51:44 +02:00 committed by GitHub
commit 0ca801af76
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog.d/zeroising_of_plaintext_buffer.txt Normal file
View File

@ -0,0 +1,4 @@
Security
* Zeroising of plaintext buffers in mbedtls_ssl_read() to erase unused
application data from memory. Reported in #689 by
Johan Uppman Bruce of Sectra.

4
library/ssl_tls.c
View File

@ -8656,6 +8656,10 @@ int mbedtls_ssl_read( mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
memcpy( buf, ssl->in_offt, n ); memcpy( buf, ssl->in_offt, n );
ssl->in_msglen -= n; ssl->in_msglen -= n;
/* Zeroising the plaintext buffer to erase unused application data
from the memory. */
mbedtls_platform_zeroize( ssl->in_offt, n );
if( ssl->in_msglen == 0 ) if( ssl->in_msglen == 0 )
{ {
/* all bytes consumed */ /* all bytes consumed */