com php-src: sodium ext: clear the hash state after we're done hashing: ext/sodium/libsodium.c

Commit: 2c4010f0fe406cbc40b4f0e8f17f8d99b47c1348 Author: Frank Denis <github@pureftpd.org> Thu, 20 Jul 2017 20:17:52 +0200 Parents: 22a5f554a8766d63fd2c2ce91a90ebacb13c0f6a Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2c4010f0fe406cbc40b4f0e8f17f8d99b47c1348 Log: sodium ext: clear the hash state after we're done hashing Changed paths: M ext/sodium/libsodium.c Diff: diff --git a/ext/sodium/libsodium.c b/ext/sodium/libsodium.c index 2a3c8eb..e0b5b91 100644 --- a/ext/sodium/libsodium.c +++ b/ext/sodium/libsodium.c @@ -852,6 +852,7 @@ PHP_FUNCTION(sodium_crypto_generichash_update) memcpy(&state_tmp, state, sizeof state_tmp); if (crypto_generichash_update((void *) &state_tmp, msg, (unsigned long long) msg_len) != 0) { + sodium_memzero(&state_tmp, sizeof state_tmp); zend_throw_exception(sodium_exception_ce, "internal error", 0); return; } @@ -896,10 +897,12 @@ PHP_FUNCTION(sodium_crypto_generichash_final) if (crypto_generichash_final((void *) &state_tmp, (unsigned char *) ZSTR_VAL(hash), (size_t) hash_len) != 0) { + sodium_memzero(&state_tmp, sizeof state_tmp); zend_string_free(hash); zend_throw_exception(sodium_exception_ce, "internal error", 0); return; } + sodium_memzero(&state_tmp, sizeof state_tmp); sodium_memzero(state, state_len); convert_to_null(state_zv); ZSTR_VAL(hash)[hash_len] = 0; @@ -2640,6 +2643,7 @@ PHP_FUNCTION(sodium_crypto_kx_client_session_keys) crypto_generichash_update(&h, client_pk, crypto_kx_PUBLICKEYBYTES); crypto_generichash_update(&h, server_pk, crypto_kx_PUBLICKEYBYTES); crypto_generichash_final(&h, session_keys, 2 * crypto_kx_SESSIONKEYBYTES); + sodium_memzero(&h, sizeof h); array_init(return_value); add_next_index_stringl(return_value, (const char *) session_keys, @@ -2688,6 +2692,7 @@ PHP_FUNCTION(sodium_crypto_kx_server_session_keys) crypto_generichash_update(&h, client_pk, crypto_kx_PUBLICKEYBYTES); crypto_generichash_update(&h, server_pk, crypto_kx_PUBLICKEYBYTES); crypto_generichash_final(&h, session_keys, 2 * crypto_kx_SESSIONKEYBYTES); + sodium_memzero(&h, sizeof h); array_init(return_value); add_next_index_stringl(return_value, (const char *) session_keys + crypto_kx_SESSIONKEYBYTES,