Introduce polarssl_zeroize() instead of memset() for zeroization
diff --git a/library/x509_csr.c b/library/x509_csr.c
index 529e7e4..d82679d 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -62,6 +62,11 @@
#include <stdio.h>
#endif
+/* Implementation that should never be optimized out by the compiler */
+static void polarssl_zeroize( void *v, size_t n ) {
+ volatile unsigned char *p = v; while( n-- ) *p++ = 0;
+}
+
/*
* Version ::= INTEGER { v1(0) }
*/
@@ -295,7 +300,7 @@
ret = x509_csr_parse( csr, buf, n );
- memset( buf, 0, n + 1 );
+ polarssl_zeroize( buf, n + 1 );
polarssl_free( buf );
return( ret );
@@ -429,17 +434,17 @@
{
name_prv = name_cur;
name_cur = name_cur->next;
- memset( name_prv, 0, sizeof( x509_name ) );
+ polarssl_zeroize( name_prv, sizeof( x509_name ) );
polarssl_free( name_prv );
}
if( csr->raw.p != NULL )
{
- memset( csr->raw.p, 0, csr->raw.len );
+ polarssl_zeroize( csr->raw.p, csr->raw.len );
polarssl_free( csr->raw.p );
}
- memset( csr, 0, sizeof( x509_csr ) );
+ polarssl_zeroize( csr, sizeof( x509_csr ) );
}
#endif /* POLARSSL_X509_CSR_PARSE_C */