[tor-commits] [tor/maint-0.2.7] Make memwipe() do nothing when passed a NULL pointer or zero size

[nickm]

commit fb7d1f41b409761be3381efaeec0f56d2a470a9f
Author: teor (Tim Wilson-Brown) 
Date:   Tue Jan 19 11:22:58 2016 +1100

Make memwipe() do nothing when passed a NULL pointer or zero size

Check size argument to memwipe() for underflow.

Closes bug #18089. Reported by "gk", patch by "teor".
Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
commit 49dd5ef3 on 7 Nov 2012.
---
 changes/bug18089| 6 ++
 src/common/crypto.c | 8 
 2 files changed, 14 insertions(+)

diff --git a/changes/bug18089 b/changes/bug18089
new file mode 100644
index 000..c1fb342
--- /dev/null
+++ b/changes/bug18089
@@ -0,0 +1,6 @@
+  o Minor fixes (security):
+- Make memwipe() do nothing when passed a NULL pointer
+  or zero size. Check size argument to memwipe() for underflow.
+  Closes bug #18089. Reported by "gk", patch by "teor".
+  Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
+  commit 49dd5ef3 on 7 Nov 2012.
diff --git a/src/common/crypto.c b/src/common/crypto.c
index 925beb3..f913917 100644
--- a/src/common/crypto.c
+++ b/src/common/crypto.c
@@ -2972,6 +2972,7 @@ secret_to_key(char *key_out, size_t key_out_len, const 
char *secret,
 /**
  * Destroy the sz bytes of data stored at mem, setting them to
  * the value byte.
+ * If mem is NULL or sz is zero, nothing happens.
  *
  * This function is preferable to memset, since many compilers will happily
  * optimize out memset() when they can convince themselves that the data being
@@ -2989,6 +2990,13 @@ secret_to_key(char *key_out, size_t key_out_len, const 
char *secret,
 void
 memwipe(void *mem, uint8_t byte, size_t sz)
 {
+  if (mem == NULL || sz == 0) {
+return;
+  }
+
+  /* Data this large is likely to be an underflow. */
+  tor_assert(sz < SIZE_T_CEILING);
+
   /* Because whole-program-optimization exists, we may not be able to just
* have this function call "memset".  A smart compiler could inline it, then
* eliminate dead memsets, and declare itself to be clever. */



___
tor-commits mailing list
tor-commits@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits

[tor-commits] [tor/maint-0.2.7] Make memwipe() do nothing when passed a NULL pointer or zero size

[nickm]

commit db8156533133836b19bca51f7fabba4d161b6ba2
Author: teor (Tim Wilson-Brown) 
Date:   Tue Jan 19 11:22:58 2016 +1100

Make memwipe() do nothing when passed a NULL pointer or zero size

Check size argument to memwipe() for underflow.

Closes bug #18089. Reported by "gk", patch by "teor".
Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
commit 49dd5ef3 on 7 Nov 2012.
---
 changes/bug18089|6 ++
 src/common/crypto.c |8 
 2 files changed, 14 insertions(+)

diff --git a/changes/bug18089 b/changes/bug18089
new file mode 100644
index 000..c1fb342
--- /dev/null
+++ b/changes/bug18089
@@ -0,0 +1,6 @@
+  o Minor fixes (security):
+- Make memwipe() do nothing when passed a NULL pointer
+  or zero size. Check size argument to memwipe() for underflow.
+  Closes bug #18089. Reported by "gk", patch by "teor".
+  Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
+  commit 49dd5ef3 on 7 Nov 2012.
diff --git a/src/common/crypto.c b/src/common/crypto.c
index 218c7be..4e0b383 100644
--- a/src/common/crypto.c
+++ b/src/common/crypto.c
@@ -3012,6 +3012,7 @@ base32_decode(char *dest, size_t destlen, const char 
*src, size_t srclen)
 /**
  * Destroy the sz bytes of data stored at mem, setting them to
  * the value byte.
+ * If mem is NULL or sz is zero, nothing happens.
  *
  * This function is preferable to memset, since many compilers will happily
  * optimize out memset() when they can convince themselves that the data being
@@ -3029,6 +3030,13 @@ base32_decode(char *dest, size_t destlen, const char 
*src, size_t srclen)
 void
 memwipe(void *mem, uint8_t byte, size_t sz)
 {
+  if (mem == NULL || sz == 0) {
+return;
+  }
+
+  /* Data this large is likely to be an underflow. */
+  tor_assert(sz < SIZE_T_CEILING);
+
   /* Because whole-program-optimization exists, we may not be able to just
* have this function call "memset".  A smart compiler could inline it, then
* eliminate dead memsets, and declare itself to be clever. */



___
tor-commits mailing list
tor-commits@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits