From e5e71f2857275189577ab7b227608ab4ec985471 Mon Sep 17 00:00:00 2001 From: Rich Salz Date: Tue, 8 Nov 2016 15:56:04 -0500 Subject: Zero stack variable with DSA nonce Thanks to Falko Strenzke for bringing this to our attention. Reviewed-by: Andy Polyakov (Merged from https://github.com/openssl/openssl/pull/1882) --- crypto/bn/bn_rand.c | 1 + 1 file changed, 1 insertion(+) (limited to 'crypto/bn') diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c index c577fd169d..9ce4c5f606 100644 --- a/crypto/bn/bn_rand.c +++ b/crypto/bn/bn_rand.c @@ -253,5 +253,6 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range, err: OPENSSL_free(k_bytes); + OPENSSL_cleanse(private_bytes, sizeof(private_bytes)); return ret; } -- cgit v1.2.3