mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-04-16 08:42:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

PAKE driver: fix password releasing

Browse Source 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
This commit is contained in:
Przemek Stekiel 2023-02-21 12:19:27 +01:00
parent 80a8849903
commit ce131bf5c5
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
library/psa_crypto_pake.c
View File

@ -254,11 +254,13 @@ psa_status_t mbedtls_psa_pake_setup(mbedtls_psa_pake_operation_t *operation,
(void) operation; (void) operation;
(void) inputs; (void) inputs;
#endif #endif
{ return PSA_ERROR_NOT_SUPPORTED; } { status = PSA_ERROR_NOT_SUPPORTED; }
error: error:
mbedtls_platform_zeroize(operation->password, operation->password_len); /* When driver fails with PSA_ERROR_NOT_SUPPORTED the built-in implementation is executed (if available)
mbedtls_free(operation->password); and it will reallocate the password leading to the memory leak.
Call abort explicitly to clean up allocated memory for password on failure. */
mbedtls_psa_pake_abort(operation);
return status; return status;
} }
@ -518,13 +520,13 @@ psa_status_t mbedtls_psa_pake_get_implicit_key(
psa_status_t mbedtls_psa_pake_abort(mbedtls_psa_pake_operation_t *operation) psa_status_t mbedtls_psa_pake_abort(mbedtls_psa_pake_operation_t *operation)
{ {
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE) mbedtls_platform_zeroize(operation->password, operation->password_len);
mbedtls_free(operation->password);
operation->password = NULL;
operation->password_len = 0;
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE)
if (operation->alg == PSA_ALG_JPAKE) { if (operation->alg == PSA_ALG_JPAKE) {
mbedtls_platform_zeroize(operation->password, operation->password_len);
mbedtls_free(operation->password);
operation->password = NULL;
operation->password_len = 0;
operation->role = PSA_PAKE_ROLE_NONE; operation->role = PSA_PAKE_ROLE_NONE;
mbedtls_platform_zeroize(operation->buffer, MBEDTLS_PSA_JPAKE_BUFFER_SIZE); mbedtls_platform_zeroize(operation->buffer, MBEDTLS_PSA_JPAKE_BUFFER_SIZE);
operation->buffer_length = 0; operation->buffer_length = 0;