wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-07 13:20:52 +02:00
Code Issues Packages Projects Releases Wiki Activity

Zeroize sniffer watch key buffer before free

Browse Source 
F-2143

ssl_SetWatchKey_file loaded a private key file into a heap buffer and
freed it without ForceZero on both error and success paths. Zeroize
before XFREE.
This commit is contained in:
Juliusz Sosinowicz
2026-04-17 16:46:43 +02:00
parent 4c8adc5046
commit 9790719955
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/sniffer.c
+4
View File
@@ -7242,12 +7242,16 @@ int ssl_SetWatchKey_file(void* vSniffer, const char* keyFile, int keyType,
ret = LoadKeyFile(&keyBuf, &keyBufSz, keyFile, 0, keyType, password);
if (ret < 0) {
SetError(KEY_FILE_STR, error, NULL, 0);
if (keyBuf != NULL) {
ForceZero(keyBuf, keyBufSz);
}
XFREE(keyBuf, NULL, DYNAMIC_TYPE_X509);
return WOLFSSL_FATAL_ERROR;
}
ret = ssl_SetWatchKey_buffer(vSniffer, keyBuf, keyBufSz, FILETYPE_DER,
error);
ForceZero(keyBuf, keyBufSz);
XFREE(keyBuf, NULL, DYNAMIC_TYPE_X509);
return ret;