RE: [PHP-CVS] com php-src: sodium ext: clear the hash state after we're done hashing: ext/sodium/libsodium.c

Hi, > -----Original Message----- > From: Frank Denis [mailto:jedisct1@php.net] > Sent: Friday, July 21, 2017 2:02 PM > To: php-cvs@lists.php.net > Subject: [PHP-CVS] com php-src: sodium ext: clear the hash state after we're > done hashing: ext/sodium/libsodium.c > > Commit: 557029e8e6fa621d3951f7f912a6755bedb49901 > Author: Frank Denis <github@pureftpd.org> Thu, 20 Jul 2017 20:17:52 > +0200 > Parents: d8a14e2aadb938845f27ac1f571be5cb28e04c24 > Branches: PHP-7.2 > Please check https://wiki.php.net/vcs/gitworkflow , lower branches have to be always merged through up into the master. Regards Anatol > Link: http://git.php.net/?p=php- > src.git;a=commitdiff;h=557029e8e6fa621d3951f7f912a6755bedb49901 > > Log: > sodium ext: clear the hash state after we're done hashing > > Changed paths: > M ext/sodium/libsodium.c > > > Diff: > diff --git a/ext/sodium/libsodium.c b/ext/sodium/libsodium.c index > 2a3c8eb..e0b5b91 100644 > --- a/ext/sodium/libsodium.c > +++ b/ext/sodium/libsodium.c > @@ -852,6 +852,7 @@ PHP_FUNCTION(sodium_crypto_generichash_update) > memcpy(&state_tmp, state, sizeof state_tmp); > if (crypto_generichash_update((void *) &state_tmp, msg, > (unsigned > long long) msg_len) != 0) { > + sodium_memzero(&state_tmp, sizeof state_tmp); > zend_throw_exception(sodium_exception_ce, "internal error", > 0); > return; > } > @@ -896,10 +897,12 @@ PHP_FUNCTION(sodium_crypto_generichash_final) > if (crypto_generichash_final((void *) &state_tmp, > (unsigned > char *) ZSTR_VAL(hash), > (size_t) > hash_len) != 0) { > + sodium_memzero(&state_tmp, sizeof state_tmp); > zend_string_free(hash); > zend_throw_exception(sodium_exception_ce, "internal error", > 0); > return; > } > + sodium_memzero(&state_tmp, sizeof state_tmp); > sodium_memzero(state, state_len); > convert_to_null(state_zv); > ZSTR_VAL(hash)[hash_len] = 0; > @@ -2640,6 +2643,7 @@ > PHP_FUNCTION(sodium_crypto_kx_client_session_keys) > crypto_generichash_update(&h, client_pk, > crypto_kx_PUBLICKEYBYTES); > crypto_generichash_update(&h, server_pk, > crypto_kx_PUBLICKEYBYTES); > crypto_generichash_final(&h, session_keys, 2 * > crypto_kx_SESSIONKEYBYTES); > + sodium_memzero(&h, sizeof h); > array_init(return_value); > add_next_index_stringl(return_value, > (const char *) session_keys, > @@ -2688,6 +2692,7 @@ > PHP_FUNCTION(sodium_crypto_kx_server_session_keys) > crypto_generichash_update(&h, client_pk, > crypto_kx_PUBLICKEYBYTES); > crypto_generichash_update(&h, server_pk, > crypto_kx_PUBLICKEYBYTES); > crypto_generichash_final(&h, session_keys, 2 * > crypto_kx_SESSIONKEYBYTES); > + sodium_memzero(&h, sizeof h); > array_init(return_value); > add_next_index_stringl(return_value, > (const char *) session_keys + > crypto_kx_SESSIONKEYBYTES, > > > -- > PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: > http://www.php.net/unsub.php