diff mbox series

[Openvpn-devel,v1] crypto_openssl: Clear PEM decoded key data before freeing it

Message ID 20261101214645.22350-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] crypto_openssl: Clear PEM decoded key data before freeing it |

Commit Message

Gert Doering Nov. 1, 2026, 9:46 p.m. UTC 
  From: Hansaem Wi <hansaemw@gmail.com>

crypto_pem_decode() decodes the tls-crypt-v2 client and server keys
and the auth-token key, and frees the decoded key bytes it got from
PEM_read_bio() with OPENSSL_free(). Use OPENSSL_clear_free() instead.

Assisted-by: Claude Code:claude-opus-5-5
Change-Id: I6b42785de99ee1e6b555d8c5e61ebe2ae784510e
Signed-off-by: Hansaem Wi <hansaemw@gmail.com>
Acked-by: Steffan Karger <steffan@karger.me>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Steffan Karger <steffan@karger.me>
diff mbox series

Patch

diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
index e6abd8f..e6873bb 100644
--- a/src/openvpn/crypto_openssl.c
+++ b/src/openvpn/crypto_openssl.c
@@ -528,7 +528,7 @@ 
 cleanup:
     OPENSSL_free(name_read);
     OPENSSL_free(header_read);
-    OPENSSL_free(data_read);
+    OPENSSL_clear_free(data_read, data_read_len);
     if (!BIO_free(bio))
     {
         ret = false;