Print this page
9642 PKCS#11 softtoken should use explicit_bzero
Reviewed by: Dan McDonald <danmcd@joyent.com>
Reviewed by: Alex Wilson <alex.wilson@joyent.com>

Split Close
Expand all
Collapse all
          --- old/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelKeys.c
          +++ new/usr/src/lib/pkcs11/pkcs11_kernel/common/kernelKeys.c
↓ open down ↓ 13 lines elided ↑ open up ↑
  14   14   * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  /*
  22   22   * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23   23   * Use is subject to license terms.
       24 + * Copyright 2018, Joyent, Inc.
  24   25   */
  25   26  
  26   27  #include <strings.h>
  27   28  #include <errno.h>
  28   29  #include <ecc_impl.h>
  29   30  #include <security/cryptoki.h>
  30   31  #include <sys/crypto/ioctl.h>
  31   32  #include "kernelGlobal.h"
  32   33  #include "kernelSession.h"
  33   34  #include "kernelObject.h"
↓ open down ↓ 302 lines elided ↑ open up ↑
 336  337          (void) remove_one_attribute(newTemplate, CKA_VALUE_LEN,
 337  338              attr_count, B_FALSE);
 338  339  
 339  340          rv = kernel_build_object(newTemplate, attr_count - 1,
 340  341              new_objp, session_p, KERNEL_GEN_KEY);
 341  342          if (rv != CRYPTO_SUCCESS) {
 342  343                  goto failed_exit;
 343  344          }
 344  345          new_objp->is_lib_obj = B_TRUE;
 345  346          new_objp->session_handle = (CK_SESSION_HANDLE)session_p;
 346      -        (void) free(newTemplate);
 347      -        bzero(key_buf, key_len);
 348      -        (void) free(key_buf);
      347 +        free(newTemplate);
      348 +        freezero(key_buf, key_len);
 349  349          return (CKR_OK);
 350  350  
 351  351  failed_exit:
 352  352          free_attributes(obj_ngk.ngk_in_attributes, &obj_ngk.ngk_in_count);
 353  353          free_attributes(obj_ngk.ngk_out_attributes, &obj_ngk.ngk_out_count);
 354      -        if (key_buf != NULL) {
 355      -                bzero(key_buf, key_len);
 356      -                (void) free(key_buf);
 357      -        }
 358      -        if (newTemplate != NULL) {
 359      -                (void) free(newTemplate);
 360      -        }
      354 +        freezero(key_buf, key_len);
      355 +        free(newTemplate);
 361  356          return (rv);
 362  357  }
 363  358  
 364  359  CK_RV
 365  360  C_GenerateKey(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism,
 366  361      CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phKey)
 367  362  {
 368  363          CK_RV                   rv = CKR_OK;
 369  364          kernel_session_t        *session_p;
 370  365          kernel_object_t         *new_objp = NULL;
↓ open down ↓ 2112 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX