9642 PKCS#11 softtoken should use explicit_bzero
Reviewed by: Dan McDonald <danmcd@joyent.com>
Reviewed by: Alex Wilson <alex.wilson@joyent.com>

@@ -20,10 +20,11 @@
  */
 
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2012 Milan Jurik. All rights reserved.
+ * Copyright (c) 2018, Joyent. Inc.
  */
 
 #include <stdlib.h>
 #include <string.h>
 #include <strings.h>

@@ -85,11 +86,11 @@
         /*
          * Realloc() may free() or shrink previous memory location, so
          * clear out potentially sensitive data before that happens.
          */
         if (dst->big_value != NULL)
-                (void) memset(dst->big_value, 0x0, dst->big_value_len);
+                explicit_bzero(dst->big_value, dst->big_value_len);
 
         padding = (src->big_value[0] < 0x80) ? 0 : 1;
         dst->big_value_len = src->big_value_len + padding;
 
         dst->big_value = realloc(dst->big_value, dst->big_value_len);

@@ -336,14 +337,11 @@
         *buf_len = p8obj_octs->bv_len;
         (void) memcpy(buf, p8obj_octs->bv_val, *buf_len);
 
 cleanup_rsapri2asn:
 
-        if (tmp_pad.big_value != NULL) {
-                (void) memset(tmp_pad.big_value, 0x0, tmp_pad.big_value_len);
-                free(tmp_pad.big_value);
-        }
+        freezero(tmp_pad.big_value, tmp_pad.big_value_len);
 
         if (key_asn != NULLBER)
                 ber_free(key_asn, 1);
 
         if (key_octs != NULL)

@@ -525,14 +523,11 @@
         *buf_len = p8obj_octs->bv_len;
         (void) memcpy(buf, p8obj_octs->bv_val, *buf_len);
 
 cleanup_dsapri2asn:
 
-        if (tmp_pad.big_value != NULL) {
-                (void) memset(tmp_pad.big_value, 0x0, tmp_pad.big_value_len);
-                free(tmp_pad.big_value);
-        }
+        freezero(tmp_pad.big_value, tmp_pad.big_value_len);
 
         if (key_asn != NULLBER)
                 ber_free(key_asn, 1);
 
         if (key_octs != NULL)

@@ -699,14 +694,11 @@
         *buf_len = p8obj_octs->bv_len;
         (void) memcpy(buf, p8obj_octs->bv_val, *buf_len);
 
 cleanup_dhpri2asn:
 
-        if (tmp_pad.big_value != NULL) {
-                (void) memset(tmp_pad.big_value, 0x0, tmp_pad.big_value_len);
-                free(tmp_pad.big_value);
-        }
+        freezero(tmp_pad.big_value, tmp_pad.big_value_len);
 
         if (key_asn != NULLBER)
                 ber_free(key_asn, 1);
 
         if (key_octs != NULL)

@@ -891,14 +883,11 @@
         *buf_len = p8obj_octs->bv_len;
         (void) memcpy(buf, p8obj_octs->bv_val, *buf_len);
 
 cleanup_x942dhpri2asn:
 
-        if (tmp_pad.big_value != NULL) {
-                (void) memset(tmp_pad.big_value, 0x0, tmp_pad.big_value_len);
-                free(tmp_pad.big_value);
-        }
+        freezero(tmp_pad.big_value, tmp_pad.big_value_len);
 
         if (key_asn != NULLBER)
                 ber_free(key_asn, 1);
 
         if (key_octs != NULL)

@@ -1238,15 +1227,11 @@
         bigint_attr_cleanup(KEY_PRI_RSA_EXPO2(keyp));
         bigint_attr_cleanup(KEY_PRI_RSA_COEF(keyp));
 
 cleanup_asn2rsapri:
 
-        if (tmp_nopad.big_value != NULL) {
-                (void) memset(tmp_nopad.big_value, 0x0,
-                    tmp_nopad.big_value_len);
-                free(tmp_nopad.big_value);
-        }
+        freezero(tmp_nopad.big_value, tmp_nopad.big_value_len);
 
         if (p8obj_asn != NULLBER)
                 ber_free(p8obj_asn, 1);
 
         if (key_octs.bv_val != NULL)

@@ -1446,15 +1431,11 @@
         bigint_attr_cleanup(KEY_PRI_DSA_BASE(keyp));
         bigint_attr_cleanup(KEY_PRI_DSA_VALUE(keyp));
 
 cleanup_asn2dsapri:
 
-        if (tmp_nopad.big_value != NULL) {
-                (void) memset(tmp_nopad.big_value, 0x0,
-                    tmp_nopad.big_value_len);
-                free(tmp_nopad.big_value);
-        }
+        freezero(tmp_nopad.big_value, tmp_nopad.big_value_len);
 
         if (p8obj_asn != NULLBER)
                 ber_free(p8obj_asn, 1);
 
         if (key_octs.bv_val != NULL)

@@ -1630,15 +1611,11 @@
         bigint_attr_cleanup(KEY_PRI_DH_BASE(keyp));
         bigint_attr_cleanup(KEY_PRI_DH_VALUE(keyp));
 
 cleanup_asn2dhpri:
 
-        if (tmp_nopad.big_value != NULL) {
-                (void) memset(tmp_nopad.big_value, 0x0,
-                    tmp_nopad.big_value_len);
-                free(tmp_nopad.big_value);
-        }
+        freezero(tmp_nopad.big_value, tmp_nopad.big_value_len);
 
         if (p8obj_asn != NULLBER)
                 ber_free(p8obj_asn, 1);
 
         if (key_octs.bv_val != NULL)

@@ -1838,15 +1815,11 @@
         bigint_attr_cleanup(KEY_PRI_DH942_SUBPRIME(keyp));
         bigint_attr_cleanup(KEY_PRI_DH942_VALUE(keyp));
 
 cleanup_asn2x942dhpri:
 
-        if (tmp_nopad.big_value != NULL) {
-                (void) memset(tmp_nopad.big_value, 0x0,
-                    tmp_nopad.big_value_len);
-                free(tmp_nopad.big_value);
-        }
+        freezero(tmp_nopad.big_value, tmp_nopad.big_value_len);
 
         if (p8obj_asn != NULLBER)
                 ber_free(p8obj_asn, 1);
 
         if (key_octs.bv_val != NULL)