diff options
| author |   deraadt <deraadt@openbsd.org> | 2017-05-02 03:59:44 +0000 |
|---|---|---|
| committer | deraadt <deraadt@openbsd.org> | 2017-05-02 03:59:44 +0000 |
| commit | 7de8a6843ca16b4f1c9d2a7eab4c71e8af96a4e6 (patch) | |
| tree | 3ea360fbba39840d58df496af1ccadf16612454f /lib/libcrypto/rsa/rsa_sign.c | |
| parent | Matching vmd(8) part of previous diff (first part of vmctl send/receive). (diff) | |
| download | wireguard-openbsd-7de8a6843ca16b4f1c9d2a7eab4c71e8af96a4e6.tar.xz wireguard-openbsd-7de8a6843ca16b4f1c9d2a7eab4c71e8af96a4e6.zip | |
use freezero() instead of memset/explicit_bzero + free. Substantially
reduces conditional logic (-218, +82).
MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c
wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and
BN_FLG_STATIC_DATA where the condition cannot be collapsed completely.
Passes regress. ok beck
Diffstat (limited to 'lib/libcrypto/rsa/rsa_sign.c')
| -rw-r--r-- | lib/libcrypto/rsa/rsa_sign.c | 16 |
1 files changed, 5 insertions, 11 deletions
diff --git a/lib/libcrypto/rsa/rsa_sign.c b/lib/libcrypto/rsa/rsa_sign.c index 818b88c604b..6e9e869f0a5 100644 --- a/lib/libcrypto/rsa/rsa_sign.c +++ b/lib/libcrypto/rsa/rsa_sign.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rsa_sign.c,v 1.28 2017/04/28 22:46:40 beck Exp $ */ +/* $OpenBSD: rsa_sign.c,v 1.29 2017/05/02 03:59:45 deraadt Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -135,10 +135,8 @@ RSA_sign(int type, const unsigned char *m, unsigned int m_len, else *siglen = i; - if (type != NID_md5_sha1) { - explicit_bzero(tmps, (unsigned int)j + 1); - free(tmps); - } + if (type != NID_md5_sha1) + freezero(tmps, (unsigned int)j + 1); return (ret); } @@ -232,12 +230,8 @@ int_rsa_verify(int dtype, const unsigned char *m, unsigned int m_len, ret = 1; } err: - if (sig != NULL) - X509_SIG_free(sig); - if (s != NULL) { - explicit_bzero(s, (unsigned int)siglen); - free(s); - } + X509_SIG_free(sig); + freezero(s, (unsigned int)siglen); return ret; } |