don't use memset() in privacy/security relevant code parts
As memset() can be optimized out by a compiler it should not be used in privacy/security relevant code parts. OpenSSL provides the safe OPENSSL_cleanse() function in crypto.h, which perfectly does the job of clean and overwrite data. For details see: http://www.viva64.com/en/b/0178/ - change memset() to OPENSSL_cleanse() where appropriate - change a hard-coded number from netbase.cpp into a sizeof()
This commit is contained in:
@@ -156,7 +156,7 @@ void RandAddSeedPerfmon()
|
||||
if (ret == ERROR_SUCCESS)
|
||||
{
|
||||
RAND_add(pdata, nSize, nSize/100.0);
|
||||
memset(pdata, 0, nSize);
|
||||
OPENSSL_cleanse(pdata, nSize);
|
||||
printf("RandAddSeed() %lu bytes\n", nSize);
|
||||
}
|
||||
#endif
|
||||
|
||||
Reference in New Issue
Block a user