yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

pem: zeroize the entire buffer in case of errors in mbedtls_pem_read_buffer()

Browse source 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This commit is contained in:
Valerio Setti 2024-02-20 10:22:36 +01:00
parent e88a1c5b85
commit 02f30230c4
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
library/pem.c
View file

@ -453,18 +453,20 @@ int mbedtls_pem_read_buffer(mbedtls_pem_context *ctx, const char *header, const
#endif /* MBEDTLS_AES_C */ #endif /* MBEDTLS_AES_C */
if (ret != 0) { if (ret != 0) {
mbedtls_free(buf); mbedtls_zeroize_and_free(buf, len);
return ret; return ret;
} }
/* Check PKCS padding and update data length based on padding info. /* Check PKCS padding and update data length based on padding info.
* This can be used to detect invalid padding data and password * This can be used to detect invalid padding data and password
* mismatches. */ * mismatches. */
ret = pem_check_pkcs_padding(buf, len, &len); size_t unpadded_len;
ret = pem_check_pkcs_padding(buf, len, &unpadded_len);
if (ret != 0) { if (ret != 0) {
mbedtls_zeroize_and_free(buf, len); mbedtls_zeroize_and_free(buf, len);
return ret; return ret;
} }
len = unpadded_len;
#else #else
mbedtls_zeroize_and_free(buf, len); mbedtls_zeroize_and_free(buf, len);
return MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE; return MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE;