nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-27 22:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Make memwipe() do nothing when passed a NULL pointer or zero size

Browse Source 
Check size argument to memwipe() for underflow.

Closes bug #18089. Reported by "gk", patch by "teor".
Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
commit 49dd5ef3 on 7 Nov 2012.
This commit is contained in:
teor (Tim Wilson-Brown) 2016-01-19 11:22:58 +11:00 committed by Nick Mathewson
parent c7b0cd9c2f
commit db81565331
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
changes/bug18089 Normal file
View File

@ -0,0 +1,6 @@
o Minor fixes (security):
- Make memwipe() do nothing when passed a NULL pointer
or zero size. Check size argument to memwipe() for underflow.
Closes bug #18089. Reported by "gk", patch by "teor".
Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
commit 49dd5ef3 on 7 Nov 2012.

8
src/common/crypto.c
View File

@ -3012,6 +3012,7 @@ base32_decode(char *dest, size_t destlen, const char *src, size_t srclen)
/**
* Destroy the <b>sz</b> bytes of data stored at <b>mem</b>, setting them to
* the value <b>byte</b>.
* If <b>mem</b> is NULL or <b>sz</b> is zero, nothing happens.
*
* This function is preferable to memset, since many compilers will happily
* optimize out memset() when they can convince themselves that the data being
@ -3029,6 +3030,13 @@ base32_decode(char *dest, size_t destlen, const char *src, size_t srclen)
void
memwipe(void *mem, uint8_t byte, size_t sz)
{
if (mem == NULL || sz == 0) {
return;
}
/* Data this large is likely to be an underflow. */
tor_assert(sz < SIZE_T_CEILING);
/* Because whole-program-optimization exists, we may not be able to just
* have this function call "memset". A smart compiler could inline it, then
* eliminate dead memsets, and declare itself to be clever. */