commit 016ebe2d0e09b2f21d61eba2f8960c0f4fffaeea
author David Benjamin <davidben@google.com> Wed Aug 02 14:26:22 2017 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Wed Aug 09 00:17:52 2017 +0000
tree 245df581e42b95791408e05d9f8d74855ee9e1b1
parent 7934f08b263e31e68ba067e666268e42e8a4011d

OPENSSL_cleanse some buffers.

See upstream's 5292833132cc863b66574fe2bbf55e4b2eff7949. Syncing just to
reduce the diff for the time being.

Change-Id: I0992d538b283d7348ef1d993973291f5416edce6
Reviewed-on: https://boringssl-review.googlesource.com/18804
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>

crypto/pem/pem_pk8.c

diff --git a/crypto/pem/pem_pk8.c b/crypto/pem/pem_pk8.c
index 550661d..15385ec 100644
--- a/crypto/pem/pem_pk8.c
+++ b/crypto/pem/pem_pk8.c
@@ -176,6 +176,7 @@
     }
     p8inf = PKCS8_decrypt(p8, psbuf, klen);
     X509_SIG_free(p8);
+    OPENSSL_cleanse(psbuf, klen);
     if (!p8inf)
         return NULL;
     ret = EVP_PKCS82PKEY(p8inf);

crypto/pem/pem_pkey.c

diff --git a/crypto/pem/pem_pkey.c b/crypto/pem/pem_pkey.c
index 058c031..9667550 100644
--- a/crypto/pem/pem_pkey.c
+++ b/crypto/pem/pem_pkey.c
@@ -114,6 +114,7 @@
         }
         p8inf = PKCS8_decrypt(p8, psbuf, klen);
         X509_SIG_free(p8);
+        OPENSSL_cleanse(psbuf, klen);
         if (!p8inf)
             goto p8err;
         ret = EVP_PKCS82PKEY(p8inf);